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(a) Introduction 


During the board meeting held on 27 February 2020, the Court of Audit (Head of SAI) 
Aruba agreed to conduct an assessment on the performance of SAI Aruba based on the 
SAI Performance Measurement Framework (PMF) model and methodology. It is in the 
opinion of the Head of SAI that it is the perfect timing to conduct such assessment, since 
SAI Aruba strives to adopt the International Standards for Supreme Audit Institutions 


(ISSAI). It is therefore important to assess the SAI’s current situation and performance. 


The SAI PMF assessment follows the SAI PMF methodology that was officially endorsed as 
an International Organization of Supreme Audit Institutions (INTOSAI) tool at the INTOSAI 
congress in Abu Dhabi in December 2016. SAI PMF is a multi-purpose, universal 
framework, and can be applied in all types of SAI’s, regardless of governance structure, 


mandate, national context and development level. 


The main purpose of the assessment for SAI Aruba is to conduct a baseline measurement 
on the current performance of the SAI in order to identify the strengths and weaknesses 
of the SAI. SAI Aruba strives to strengthen their internal performance and be able to 
demonstrate their value to their stakeholders and the citizens of Aruba. This ambition is 
in line with the current Strategic Policy plan 2019-2022. The assessment shall also serve 
as a step towards ISSAI implementation and improvement of the audit process and audit 
quality. The assessment will provide a true and clear baseline measurement on the 
performance of the organization targeting ISSAI 1, 10, 30, 40, 200, 300, 400. 

After following a basic (online) training during the month of May 2020, on the SAI PMF 
methodology, the assessment started in July 2020. The assessment covered all parts of 
the organization and not only the audit work. For instance the legal framework, internal 
government, financial assets management, human resource and communication 
management were assessed on their current performance. The time period that was 
covered during the assessment varies, depending on the evidence that was needed to 
assess each domain. For domains regarding organizational internal documents e.g. 
strategic plan, legal framework, internal procedures, we took into account the time period 
of the latest version of the document that was completed and approved or the documents 
that were effective to date. 

The selection of the sampling audit files was made, based on the type of audit that was 
carried out in the last three years (2017-2019), prior to the start of this assessment in 
year 2020. The most recent audit reports from each audit type were selected for the 


assessment. 
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(b) Independent review statement 


SAI Performance Report of the Court of Audit of Aruba dated 18.June 2021 
Independent Review Statement 


The INTOSAI Development Initiative (IDI), as operational lead on SAI PMF, provides 
support to SAI PMF assessments where requested. Such support includes conducting 
independent reviews (IR) of draft assessment reports. A request for such an IR was 
received from the Court of Audit of Aruba on 03.May 2021. 


This SAI Performance Report (SAI-PR) was prepared by Leonard Koolman (team leader), 
Eliana Croes and Jairmin Lopez-Tromp. The team leader and other team members 
together are considered to have the appropriate skills and experience to produce a high- 
quality assessment. 


The independent reviewers were selected by the SAI PMF assessment coordinator from 
SAI Aruba under delegated authority from the Head of SAI Aruba. The design of the 
independent review process was included in the assessment Terms of Reference, which 
was independently reviewed by one of IDI’s certified reviewers, and approved by the 
Head of SAI Aruba. 


In compliance with recommended SAI PMF methodology, the Head of SAI Aruba received 
the draft report for review and official comment with the objective of ensuring that the 
report is factually correct. 


The Independent review arranged by IDI was carried out by Dafina Dimitrova, IDI 
certified SAI PMF independent reviewer, who had no responsibility for preparing the SAI- 
PR, and is considered to have the appropriate knowledge and experience necessary for 
this task. The objective of this review was to ensure that the SAI PMF methodology had 
been adhered to, that the evidence in the SAI-PR was sufficient to justify the indicator 
scores and that the analysis was consistent with the evidence provided in the SAI-PR. 
The review concluded that all objectives have been satisfactorily met in the final report 
dated 18th of June 2021. 


Significant matters raised during the independent review process have been addressed 
in this version of the SAI-PR. 


Prepared by: Dafina Dimitrova 


Date: 29-06-2021 
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(C) SAI Management and Use of Results 


The aim of the SAI PMF is to conduct a baseline measurement on the performance of the 
SAI in order to identify the strengths and weaknesses of the SAI. 


The results of the SAI PMF assessment will serve as guidance and direction on the 


corrective action plan that the Head of SAI will set for the upcoming years. 


Two particular areas that came to light as a result of the assessment was the need to 
update the SAI’s legal framework and the need to enhance the quality of the reports by 
adopting the ISSAI standards. To address these two areas, the Head of SAI has been 
working since 2018 on a new National Ordinance Court of Audit. The new National 
Ordinance Court of Audit may consequently lead to changes in other legislations as well, 
such as the Constitution of Aruba, and the Compliance Regulation 1989. Changes in the 
legal framework will contribute towards the SAI’s fully financial and organizational 


independence, which will improve the SAI’s performance. 


The Head of SAI also aspires to adopt and implement the ISSAIs for conducting 
performance and compliance audit. The results of the SAI PMF assessment confirm the 
importance of developing audit standards consistent with ISSAI 300 and ISSAI 400, in 
order to improve the audit process and audit quality. It is the SAI’s intention to also 
conduct financial audit in the future. Steps towards reaching this goal has already been 
taken, by approving Certified Public Accounting (CPA) training of personnel conducting 
audits. It is nonetheless not completely within the SAI’s control, as approval in the new 
legal framework will be required by Parliament and the government and an acceptable 
financial framework should be established by Parliament, in order for the SAI to conduct 
such audit. 

SAI Aruba also expressed her interest in participating in the Strategy, Performance 
Measurement and Reporting programme? that will start in September 2021. The results of 
the SAI PMF assessment will then serve as a foundation during the program, but also for 
the SAI’s Strategic plan 2023-2025 and the SAI’s operational plans for the upcoming 
years. 

The Head of SAI Aruba and the Secretary-General expressed their appreciation of the 
assessment team’s dedicated and outstanding work and attention to detail in putting 
together this assessment. In addition, the SAI of Aruba expresses their gratitude towards 
the coach and independent reviewer of INTOSAI Development Initiative, Mr. Horacio Vieira 
of the Tribunal de Contas da Unido, Mr. Brighton Nyanga of Office of the Auditor General 
of Norway, and Mrs. Dafina Dimitrova of INTOSAI Development Initiative (IDI) in guiding 


the team and assessing the results. 





' The Strategy, Performance Measurement and Reporting initiative (SPMR) is aimed at supporting SAIs to better assess, 
plan, manage and report on their performance throughout an entire strategic management cycle. 
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(d) Key Findings and Observations on 


the SAI’s Performance and Impact 


(i) Integrated Assessment of SAI Performance 


This section includes the findings on how the SAI performs in its core functions and what 
causes the SAI’s performance. For this section, the SAI PMF team conducted a root cause 
analysis based on all aspects that influences the SAI’s performance. Based on the analysis 
results the SAI PMF team was able to determine the main root cause whereas the SAI has 
control or influence on the root cause identified. The main categories for the root cause 
analysis were defined in six categories, these are: 

e audit coverage, 

e quality of audit reports and recommendations, 

e SAI follow-up on audit results, 

e stakeholder management, 

e SAI’s independence and legal framework, and 


° audit publication. 


Low audit coverage 

1%‘ main cause identified: SAI Aruba does not conduct financial audit. 

Root of the cause: Parliament and the government has not decided on an acceptable financial 
reporting framework2. 

Level of influence: Partly outside of the SAI’s control. 

The SAI’s mandate gives the SAI the right for audit coverage in two of the three disciplines 
which are performance and compliance audit. 

The SAI’s mandate does not address specifically that the SAI should conduct a financial 
audit on the types of entities cited in the SAI’s mandate. According to the SAI’s mandate, 
the SAI should submit a report on the review of the national financial statement, and on 
the financial statement of public entities (1 entity), legal established companies and 
institutions by National Ordinance (9 entities), and of the budgetary funds (13 funds). 
The SAI’s mandate refers to the Compliance Regulation 1989? for further elaboration on 
the criteria that the financial statement needs to be examined. However, the Compliance 
Regulation 1989 does not include an acceptable financial reporting framework that the SAI 


can use to conduct a financial audit. Since the government has not yet decided on an 


? An acceptable financial framework is the set of rules used as guidelines in the preparation of financial statements. This 
information need to be relevant, complete, reliable, neutral and understandable for the intended users. 

3 The Compliance Regulation 1989 is legislation that covers all rules with regards to regulations to the manner of 
management and accountability of the country's funds. 
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acceptable financial reporting framework and there are many deficiencies in the areas of 
internal control, the SAI is not able to conduct a financial audit. Not having an acceptable 
financial framework is partly outside the SAI's control as the SAI can only, to some extent, 


influence the decision-making process by consistently reporting on these deficiencies. 


2” main cause identified: Limited Capacity. 

Root of the cause: SAI Aruba does not have a legal mandate to appoint staff. 

Level of influence: Outside of the SAI’s control. 

This SAI PMF assessment also indicates that the SAI has a low audit coverage for 
performance and compliance audits. One of the reasons for the low audit coverage is the 
limited staff capacity. Consequently, SAI Aruba cannot execute the number of audits 
planned and cannot cover many audit topics. For years, the SAI has had a capacity 
shortage of 44%*. The capacity shortage is mainly caused at the top level of the research 
department. The positions of project leaders have been vacant for years. 

The lack of staff capacity is due to the long and delay recruitment process and not finding 
suitable auditor candidates to fill the open vacancies. The delay in the recruitment process 
is attributable to not having a legal mandate to appoint staff. Also, the remuneration of 
the SAI staff is linked to the government’s conditions, which is not attractive for the 
recruitment of suitable candidates. Consequently, SAI Aruba needs to adhere to the rules 
and regulations that apply to the wider public sector. It is outside of SAI’s control to 
change the legal mandate by itself. 


3" main cause identified: Topics selection during monitoring does not follow the ISSAI principles 
for audit coverage. 

Root of the cause: Lack of a SMART? strategic/operational plan that addresses the importance of 
monitoring for topics selection. 

Level of influence: Within the SAI’s control. 

According to the SAI PMF criteria, when selecting an audit topic, the SAI should ensure to 
cover some sectors and topics within a time frame. ISSAI 5 also states that the SAI should 
be responsive to changing environments and emerging risks. 

In the past years, the SAI attempted to cover many of these aspects by conducting 
monitoring activities. Unfortunately, due to the lack of time, personnel, and a well-defined 
monitoring structure, the audit staff has not increased the audit coverage and has not 
been more responsive. 

The lack of time is attributable to not allocating sufficient time to monitoring activities in 
the year planning accordingly and not considering the relevance and importance that 
monitoring activities can have on the SAI’s audit coverage. The root cause for not 
allocating sufficient time in the year planning has to do with the lack of a 
strategic/operational plan that addresses the importance of monitoring activities for topic 


selection and ensuring that appropriate time is allocated for these activities. 


* As of 2020 the SAI secretariat has an approved formation of 18 Fte’s but has only 10 staff member in service. 
5 With SMART strategy it is meant that the strategy should be Specific, Measurable, Attainable, Relevant and Timely- 
Based. 
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The root cause of not having sufficient staff was explained in the 2"! main cause above, 
which is attributable to not having a legal mandate to appoint staff. 

The lack of a well-defined monitoring structure relates to not having a system that ensures 
that the sectors and topics for each audit type are covered. A mechanism is available to 
ensure that the SAI remains responsive to changing environments and emerging risks. 
Again, this cause is attributable to not having a SMART strategic/operational plan that 
addresses the importance of implementing the ISSAIs and developing the necessary topic 
selection manuals that cover the relevant aspects. 

It is in the SAI’s control to develop a strategic/operational plan that addresses the 
importance of monitoring for topic selection and formally adopt the ISSAI standards for 
selecting audit topics for each audit type to guarantee proper audit coverage. 


4" main cause identified: Lack of a SMART strategic plan that translate the SAI’s strategic 
goals into concrete actions to increase audit coverage. 

Root of the cause: Strategic planning cycle not in place. 

Level of influence: Within the SAI’s control. 

Another factor contributing to a low audit coverage is the lack of a strategic plan that 
translates the SAI’s strategic goals into concrete actions to increase the audit coverage. 
The absence of annual plans aligned to the strategic policy plan is the cause of not having 
actions defined on how the SAI plans to increase the audit coverage. It is in the SAI’s 
control to develop a well-formulated annual/operational plan each year, and implement a 


strategic planning cycle. 


No guarantee on the quality of audit reports and recommendations 

1% main cause identified: Lack of audit policies and standards. 

Root of the cause: ISSAIs standards not adopted and implemented. 

Level of influence: Within the SAI’s control. 

SAI Aruba cannot guarantee complete quality for its audit work, since it does not follow 
the principles for each specific audit type according to the ISSAIs. The ISSAIs describe 
the specific criteria and aspects that an audit work should include for qualitative audit 
work. The main reason for not following the principles for each specific audit type is, 
because the SAI has not yet formally adopted and implemented the ISSAI standards. 
The quality of the reports is currently guaranteed to some extent, by using audit manuals 
obtained by the SAI Netherlands and the experience and knowledge of the staff who have 
also received support from the SAI Netherlands and have conducted many audits in the 
past years. 


It is the SAI’s vision to adopt the ISSAIs, but no evidence was found that this vision has 
been concretized and prioritized. The formal adoption and implementation of standards 
and methodologies is mainly to enhance the quality for each specific audit type. The formal 
adoption and implementation of the ISSAIs are within the SAI’s control. 


2°¢ main cause identified: No quality control process. 
Root of the cause: lack of a quality control and assurance system. 
Level of influence: Within the SAI’s control. 
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The quality of the audit reports can also be affected by not having an optimal quality 
control process due to a lack of quality control and assurance system. It is in the SAI’s 
control to introduce quality control and assurance system that can guarantee the quality 


of the reports throughout the audit process. 


3 main cause identified: Lack of staff capacity. 

Root of the cause: No legal mandate to appoint staff. 

Level of influence: Legal mandate is outside the SAI’s control. 

The SAI personnel capacity also influences the quality of the audit reports. The analysis 
indicates that SAI Aruba needs to attract and retain suitable auditors with the right skills 
and experience to conduct audit work. For attaining this target, it is essential that SAI 
Aruba have a legal mandate that can allow the SAI to appoint its own staff. This will ensure 
that the recruitment and hiring process does not encounter any delay, which results in 
losing potential candidates. It is outside of SAI’s control to change the legal mandate by 
itself. 


4 main cause identified: Inadequate staff training. 

Root of the cause: No HR strategy in place to ensure auditors have the required knowledge and 
Skills. 

Level of influence: The implementation of a HR strategy is within the SAI’s control. 

The SAI’s lack of personnel training also influences the quality of the audit reports. The 
main cause identified for not having the all-around knowledge according to the ISSAI’s is 
the lack of training in specific audit types. There are no specific training plans for each 
audit discipline to enhance the skills of the audit staff further. To attain this target, the 
SAI should develop a human resource strategy that emphasizes recruitment, performance 
management, training and development, retention, and staff welfare. It is in the SAI’s 


control to develop and implement an HR strategy. 


It is important to point out and bring into perspective that SAI Aruba is a small SAI 
operating in a small island economy. It may not be feasible for the SAI to have both the 
quantity and quality of staff to carry out many audits. It is also not attainable to have 
staff specialized in specific audit types. SAI Aruba audit staff consist currently of six staff 


members and all of them conduct both performance and compliance audit. 


Follow-up on audit recommendation does not take place regularly 

1%‘ main cause identified: Follow up is not part of the annual audit plan and no follow up system 
is in place. 

Root of the cause: Follow up audit is not defined as part of the audit cycle. 

Level of influence: Within the SAI’s control. 

The assessment results indicate that the SAI does not follow-up on audit recommendations 
regularly, according to the requirements of the ISSAIs. It is essential that the SAI follow- 
up on the recommendations provided and examine what the audited entities or other 
responsible parties have done to address them. 

In recent years the SAI has not follow-up on the audit’s recommendation as required by 
the ISSAIs, except for one performance audit report published in 2019. For the 


investigation on the national financial statement, the auditors revise the previous year’s 
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audit recommendations and re-examine them in the next year audit. The SAI does not 
have any follow-up system as it is not defined as part of the audit cycle and not included 
in the annual audit plan. It is essential to update the audit cycle and include the follow- 


up on audit recommendation, which is in the SAI’s control. 


2™7 main cause identified: Lack of time for follow up. 

Root of the cause: SAI Aruba does not have a legal mandate to appoint staff. 

Level of influence: Outside the SAI’s control. 

The SAI’s follow-up is also affected by the lack of staff capacity. The current audit staff 
has limited time and therefore is not able to follow-up on the audit recommendations. 
Also, 50% of the SAI’s staffing positions are currently vacant. More staff is necessary to 
conduct a follow-up on audit recommendations and carry out more audits during a year. 
Having a mandate that allows the appointment of personnel is once more essential to 


increase the SAI’s capacity and be able to carry out more audit-related activities. 


The SAI has limited engagement with their stakeholder management 

1%* main cause identified: SAI Aruba does not have a communication procedure and appropriate 
tools. 

Root of the cause: Lack of a communication plan and strategy. 

Level of influence: Within the SAI’s control. 

As for the stakeholder engagement, the assessment indicates that the SAI has limited 
engagement with its stakeholders. The SAI does not have a well-defined communication 
strategy and plan that is translated further into a communication policy that defines the 
communication processes and procedures. The SAI’s objective is to strengthen its 
communication with all key stakeholders. However, not all stakeholders have been 
formally identified due to not having a properly defined communication plan that includes 
all stakeholders and how the engagement will take place. Once a communication plan is 
in place, the SAI can also identify the appropriate tools and approaches for external 


communication, which is within the SAI’s control. 


2™7 main cause identified: There is no proper communication throughout the audit process. 

Root of the cause: ISSAIs standards are not adopted and implemented. 

Level of influence: Within the SAI’s control. 

The assessment indicates that SAI Aruba does not maintain a proper communication 
throughout the audit process as required by the ISSAIs. 

SAI Aruba has not implemented procedures and standards that address the level of 
effective and proper communication with the relevant stakeholders throughout the audit 
process. Not having implemented the ISSAIs for each audit type, which covers this area, 
can be seen as the root cause for not having proper communication throughout the audit 


process. Implementation of the ISSAIs for each audit type is within the SAI’s control. 


Limited Independency in the legal framework 

1s* main cause identified: The independency provided in the Constitution does not guarantee a 
very high degree of initiative and autonomy. 

Root of the cause: The Constitution has not been updated. 
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Level of influence: outside the SAI’s control. 

Neither the Constitution and the National Ordinance Court of Audit Aruba states that the 
SAI has a high degree of initiative and autonomy. According to section 5 of the Lima 
Declaration, the necessary degree of the SAI’s independence should be laid down in the 
Constitution, and details may be set out in the legislation. In particular, adequate legal 
protection by a Supreme Court against any interference with the SAI’s independence and 
audit mandate. 

The SAI has the possibility to provide an initiative and has some degree of autonomy when 
it comes to managing its own budget. The independence of SAI Aruba is partly found in 
its references throughout the articles where the independence of the Head of SAI is 
addressed, related to the proper fulfilment of their positions. 

It is not easy to pinpoint the root cause for not having a Constitution that specifically 
addresses the SAI’s independence. The Constitution needs to be updated and consider the 
Lima Declaration. A change of the Constitution is outside the SAI’s control. 


24 main cause identified: The SAI is dependent on the government when it comes to 
organizational matters. 

Root of the cause: Lack of decision making regarding revision/update of legal framework. 

Level of influence: Outside the SAI’s control. 

Independence contributes to the objectivity and effectiveness of an SAI. The results of the 
assessment indicate that SAI Aruba has limited independence in the legal framework. 
Particularly for organizational matters such as the managing of human resources. Also, 
for certain financial obligations, the SAI has to follow the same procedures as government 
entities, such as closing contracts with a third party. The legal framework covering the 
organizational aspects is to some extent outdated and has not been revised and updated. 
In the past, there has been initiative towards the revision of the legal framework. Still, 
little progress was made due to a lack in the decision-making by the participating parties. 
The change in legislation is outside the SAI’s control. 


Moderate audit publication 

1% main cause identified: SAI Aruba does not engage and reach all stakeholders. 

Root of the cause: Lack of a well-defined communication strategy. 

Level of influence: Within the SAI’s control. 

The publication of the audit results was also assessed, and the results indicate that SAI 
Aruba does not engage and reach all stakeholders when they publish their reports. The 
analysis indicates that the cause is the absence of a well-defined communication strategy 
and procedure. 

Currently, the SAI does not seek feedback (e.g., in the form of surveys) from its 
stakeholders on the SAI’s reports. All communications and publications should be tailored 
to the SAI’s audience. It is therefore, essential that the SAI’s communication strategy 
covers all aspects of how SAI Aruba will reach and engage with their stakeholders, monitor 
the publication’s coverage, and for what purpose. The development of a communication 


strategy is within the control of the SAI. 
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2”? main cause identified: Lack of monitoring of the media’s coverage. 

Root of the cause: Lack of a well-defined communication strategy. 

Level of influence: Within the SAI’s control. 

The assessment indicates that the SAI does not monitor the media’s coverage due to a 
lack of a system to monitor the extent to which the media covered each audit report. As 
previously mentioned, it has mainly to do with the absence of a_ well-defined 
communication strategy and procedure. It is within the SAI’s control to introduce a 
communication strategy that covers all these areas. 

The SAI also has a lack of staff capacity to monitor media coverage. The lack of capacity 
is due to the constraint in the recruitment process, which is attributable to not having a 
legal mandate to appoint staff. It is outside of the SAI’s control to change the legal 
mandate by itself. 


(ii) The Value and Benefits of Supreme Audit Institutions- 
Making a Difference to the lives of Citizens 


= Strengthening the accountability, transparency and integrity of government and public sector 
entities 
SAI Aruba’s impact on the citizens relies significantly on the quality and credibility of its 
audit report. The SAI’s engagement with Parliament, audited entities, and other 
institutions that will use the SAI’s reports are also essential to guarantee that the findings 
and recommendations from the audit are considered. 
In the past, SAI Aruba published many reports with recommendations that resulted in 
visible improvements in the public sector. For instance, the Public Private Partnership 
report included a recommendation that the relevant government departments work closely 
and share information on the management of the public private infrastructure projects. 
The recommendations of SAI Aruba were considered, and these departments nowadays 
share more information. 
It is the SAI’s ambition to publish more reports that meet higher quality standards. 
However, SAI Aruba has many deficiencies that affect the SAI’s performance, such as an 
outdated legal framework, lack of staff, lack of a quality control system, and no audit 
standards in place. To improve the report’s quality, it is therefore essential to work 
towards implementing of such systems and standards. 
SAI Aruba has not measured the impact the SAI’s audit reports have on the government’s 
accountability, transparency, and integrity and on the public sector entities. It is, 
therefore, difficult for the SAI to measure its contribution. 
Consistently, carrying out audits will create an impact and encourage the public entities 


to be more accountable, transparent and ethical. 


"Demonstrating ongoing relevance to citizens, Parliaments and other stakeholders 
SAI’s worldwide demonstrate ongoing relevance by responding appropriately to the challenges 
of citizens, the expectations of different stakeholders, and the emerging risks and changing 


environments in which audits are carried out. 
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SAI Aruba strives to carry out audits relevant to the citizens, Parliament, and other 
stakeholders. SAI Aruba will further strengthen its external communication by intensifying 
contact times with the stakeholders and having more formal and informal meetings with 
Parliament, the Council of Ministers, and other key stakeholders. 

The audit’s relevance to the citizens and Parliament, is already considered during the 
monitoring process for audit topic selection. An example is the reports on Public Private 
Partnership and BO Aruba®. This audit provided an insight of the amount of money spent 
on infrastructure projects. Many citizens were not aware of the cost involved in these 
projects and the risks associated with them. Up to this date, some media channels still 
refer to these reports when they write news articles on the financial impact that these 
infrastructure projects had on the economy of Aruba. 

SAI Aruba also prepares a press release for all the news portals for each of their reports. 
All audit reports are also published on the SAI’s website. The press release contains a 
summary of the audit’s objectives, findings, and conclusions. For some audits that are 
relevant for the citizens, a press conference is held. A presentation to Parliament can also 
be organized upon request or by request of the Head of SAI. 

SAI Aruba does not seek feedback on its performance from any of its stakeholders. 
Moreover, it does not actively engage with its stakeholders when determining how best to 
use its resources. Besides, the lack of a formally approved and implemented 
communication plan and strategy demonstrates that there is scope for improvement in 


responding appropriately to the expectations and challenges of different stakeholders. 


=" Being a model organization through leading by example 

In some areas, SAI Aruba can be considered as being a model organization through leading 
by example. For instance, the SAI prepares and publish their annual report each year, 
according to the SAI’s mandate. The SAI’s annual report includes all audit and non-audit 
activities during the year and gives accountability on how the budget was spent. 

In 2020 SAI Aruba also contributed to some of the pillars of good governance by 
developing a code of ethics and implementing an integrity policy plan for all their staff. 
The SAI also strives to have a qualitative optimal staffing level, with all its staff being 
well-trained professionals. To achieve this goal, the SAI will focus in the near future on 
the continuous development of the required competencies and ambitions of the 


employees. 


There are areas where SAI Aruba needs to improve if the SAI intends to set an example 
for others and demonstrate that it fulfills its functions efficiently and effectively. These 
include, amongst others, improving the communication with their stakeholders, increasing 
their audit coverage, improving the strategic and annual planning process, implementing 
international audit standards such as the ISSAIs, implementing quality control and quality 
assurance system, and continuously updating and enforcing the SAI’s integrity policy. 





® The SAI published in 2018 a report named BO Aruba, that identified all infrastructure projects and their costs. 
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(iii) Analysis of the SAI’s capacity development efforts and 
prospects for further improvement 


The root cause analysis indicates that one of the causes for low audit coverage for 
compliance and performance audits is not having formally adopted the ISSAIs and not 
having a strategic planning cycle. However, the SAI uses the manuals received from SAI 
Netherlands as a guideline and has developed an annual plan in the past for the year 
2019. It is important that the SAI formally adopts and implements the ISSAI standards 
and develops an annual plan each year based on the strategic policy plan, with concrete 
actions on how the SAI plans to increase their audit coverage. The low audit coverage has 
also to do with the lack of staff. The SAI does not have a legal mandate that allows them 
to appoint their own staff. 

The SAI has been part for many years in an ongoing reform of the current National 
Ordinance Court of Audit Aruba, but unfortunately, there has been limited progress. If 
approved, the new legal mandate can allow the SAI to appoint their staff and reduce the 
time in the hiring process, resulting in an increase of audit coverage and an improvement 


of the audit quality. 


Another significant finding from the SAI assessment is that the SAI does not conduct a 
follow-up on audit recommendations since it is not formally defined as part of the audit 
cycle. The SAI needs to update and include a follow-up on audit recommendations as part 
of the SAI’s audit cycle. The initiative taken by SAI Aruba for carrying out an SAI PMF with 
the intention of implementing the ISSAIs is a step towards further improvement of the 


audit process and will also enhance the quality of the audit reports. 


Recently SAI Aruba was also assisted by an external consultancy firm in developing an 
Human Resource (HR) plan that should result in an HR handbook. The HR plan has not yet 
been formally approved but covers some aspects regarding staff appointment, increasing 
productivity, and the staff development. However, many of these aspects covered in the 
HR plan are, however, in anticipation of the new SAI’s legislation and are not possible 
under the current legislation for civil servants. 

SAI Aruba also started with a Professional Development plan for each staff. However, this 
plan does not cover the need for the staff to acquire knowledge on a specific audit type 
such as performance and compliance audit. The plan aims at the individual goals of the 
staff. 

All audit staff will also start with a Certified Public Accountant (CPA) education in the 
coming months. This education program will foster the knowledge of all auditors in the 
field of finance and audit. It will also support all auditors with the knowledge and 


acquaintance with international audit standards. 


SAI Aruba is also committed to improving its communication with all relevant stakeholders. 
However, it is not yet translated into a concrete communication plan and strategy 


supported by the appropriate tools and policies. 
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1 Assessment Methodology 


SAI Aruba’ agreed to undertake the SAI PMF assessment to conduct a baseline 

measurement on the performance of the SAI with a primary objective to identify the 

strengths and weaknesses of the SAI. SAI Aruba aims to strengthen its internal 

performance to demonstrate its value to its stakeholders and the citizens of Aruba. The 

SAI PMF assessment shall furthermore serve as a step towards ISSAI implementation and 

improvement of the audit process and audit quality, as well as its progress towards 

achieving the objectives of ISSAI 12: The Value and Benefits of Supreme Audit Institutions 

- making a difference to the lives of citizens, which lays out how SAI Aruba should work 

to: 

e strengthen the accountability, transparency, and integrity of the government and public 
sector entities, 

e demonstrate ongoing relevance to citizens, Parliament, and other stakeholders, and 

e being a model organization through leading by example. 

This assessment contributed to a true and clear baseline measurement on the performance 

of the organization targeting ISSAI 1, 10, 30, 40, 200, 300, and 400. 


Scope of SAI Aruba’s performance report 


The assessment covered all domains and indicators of the SAI PMF handbook, except those 
that were excluded and listed below. 

SAI Aruba does not outsource any of its audits. Neither do they have the mandate to 
conduct audits regarding jurisdictional control. SAI Aruba is based on the Westminster 
model and does not have a judicial mandate®. Therefore some indicators were not part of 
the assessment since they are not applicable for SAI Aruba, which are: 

SAI 5: Outsourced Audit 

SAI 8 (IV): Coverage of the jurisdictional control 

SAI 18: Jurisdictional control standards and quality management 

SAI 19: Jurisdictional control process 

SAI 20: Results of jurisdictional control 


During the assessment, the team made some small changes compared to what was 
described in the Term of Reference (TOR). The most relevant change was on reducing the 


sample of audits to three audit reports. Reason for excluding an audit report from the 





7 In Aruba, the SAI is referred to as the General Chamber of Audit. This is the term used in the Constitution of Aruba. To 
avoid any confusion, the term SAI will be used throughout the report. 

8 A Judicial mandate makes legal judgements on compliance with laws and regulations, and exercises a budget control 
function to assure that public funds are well used. (source: www.worldbank.org). 
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audit scope is that the report - Insights on subsidy- cannot be categorized as a 
performance audit, as was mentioned in the ToR. This report does not contain a conclusion 
nor recommendations. Noteworthy is that the team assessed the financial audit part, even 
though SAI Aruba does not conduct financial audits, due to the absence of a formal 
financial reporting framework. All the criteria were therefore assessed as not met, by the 
team. The SAI’s mandates does not address specifically that the SAI should conduct 
financial audit. However, the SAI’s mandate mentions that the SAI should submit a report 
on the review of the national financial statement of the government of Aruba, and the 
financial statements of all entities described in its mandate. It is the SAI’s intention to 
carry out financial audit in the future and therefore it is important for SAI Aruba to be 


aware of the current deficiencies. 


Process of preparing SAI Aruba’s-Performance Report 


The SAI-PMF assessment preparation commenced in May 2020 with an intensive course 
and guidance on the SAI-PMF tools. The assessment fieldwork was conducted from July 
through October 2020 at the SAI in Aruba. During this period, the team also carried out 
the data collection for the assessment. 


To ensure the assessment’s quality, the team opted to exclude team members that were 
involved with an audit report from assessing their own work. Also, a separate staff member 
was chosen as a quality controller. The quality controller for the SAI PMF has 19 years of 
experience in the SAI and, during that time, conducted many investigations. The quality 
controller was also responsible for the development of the integrity policy plan and code 
of ethics. 

Also, to guarantee the assessment quality, there were two other levels of quality 
management: quality control within the team by the team leader, and the independent 
review by the IDI. 

The team members have been part of SAI Aruba for many years, and all of them have 
conducted many audits during the years. The following table presents further information 


on the assessment team. 


Table 1: Assessment team 
Name Xo} [3 SAI years Audit Field 


Leonard Koolman ae Compliance audit and Performance audit. 


The team leader served as Head of Operations prior to the function of researcher, and was 





involved with both the daily operations and support of the research department. In the 
past, the team leader was also responsible for preparing some of the operational guidelines 


and procedures. 


Data collection methods 


The methods used for gathering data and information included document review, review 


of a sample of audit files, and interviews with the acting chairman, Secretary-General, and 
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staff members. Interviews were held in both formal and informal settings. Since the SAI 
is a small organization consisting of ten employees, and everyone in the organization was 
aware of the assessment, there was good cooperation during the assessment. 

Both the Secretary-General and some staff members were contacted during the 
assessment and asked direct questions and guidance. The acting chairman was also very 
cooperative during the assessment by answering all necessary questions and following up 


on the assessment’s progress. 


The documentation review included many sources such as the Constitutional law, SAI 
legislation, national legislation, organizational documents (handbooks and policies), audit 
files, published reports, websites, and other relevant material. 

Annex 3 lists the documentation, sources, and evidence that were reviewed and used by 
the assessment team. The scoring of the criteria was based on the assessment of this 
evidence. 

It is important to mention that the availability of evidence was a critical factor when 
assessing each criteria. Where no evidence was available, and no professional judgment 
could be granted, the criteria was scored as “not met” and a proper explanation was 
included. The team opted to use a conservative approach when assessing each criteria to 
give a more realistic view on the organization current weaknesses. This will help SAI Aruba 


to address the areas that it needs to improve. 


Recent audit work 

In the recent audit work, SAI Aruba did conduct investigations on the national financial 
statements and conduct performance and compliance audits. The audits that were 
previously conducted by SAI Aruba (2017-2020) were not fully in line with the ISSAI 
standards. However, it is the Head of the SAI’s intention to adopt the ISSAIs for all audit 


work. 


The following table presents all the published reports for the period of 2017-2019. 


Table 2: Published reports 2017-2019 


Audits reports Published Type of audit Selected audit work 
year 


BO Aruba: an investigation into 2018 Descriptive audit No, cannot be categorized as one of the 





infrastructure projects and a audit disciplines — financial, 
representation of risks. performance or compliance - audit 
because it did not follow the principles 


of the above mentioned audit types. 


Investigation on the national Compliance audit Yes, categorized as a compliance audit. 


financial statement for the year 

2017. 

Review on the preparedness for Descriptive audit No, cannot be categorized as one of the 
implementation of Sustainable audit disciplines — financial, 
Development Goals in Aruba. performance or compliance - audit 


because of its limited content. 
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Published 
year 


2019 
2019 


Audits reports 


Insights on subsidy. 


Public Private Partnership: 
investigation of the contract 
management and provision of 
information regarding the 
projects Green Corridor and 
Watty Vos Boulevard. 

Causes overtime perspective of 
KPA, KIA and CEA?. 


Type of audit 


Quickscan® audit: 


the report does 
not have 
conclusions nor 
recommendations. 


Performance audit 


Quickscan audit: 
the report does 


not have 


Selected audit work 


No, cannot be categorized as one of the 
audit disciplines — financial, performance 
or compliance - audit because it did not 
follow the principles of the above 
mentioned audit types. 

Yes, categorized as a performance audit, 
because to some extent it meets the 
criteria of a performance audit and have 


partially characteristics of such an audit. 


No, cannot be categorized as one of the 
audit disciplines — financial, performance 


or compliance - audit because it did not 


conclusions nor follow the principles of the above 


2020 


The following audit work was selected for the SAI PMF assessment: 


recommendations. | mentioned audit types. 


Investigation on the National Compliance audit Yes, categorized as a compliance audit. 
Financial statement for the year 


2018. 


Because of the limited published reports 
in the years 2017-2019, SAI Aruba 
decided to 
sample, although 


include this report in the 
it is not within the 
audit scope of this assessment. This 


report was published in July 2020. 





1. Investigation on the National Financial statement for the year 2017. Type of audit: 
compliance audit. Year Published: 2018. 

2. Public Private Partnership: Investigation of the contract management and provision of 
information regarding the projects Green Corridor and Watty Vos Boulevard. Type of 
audit: performance audit. Year published: 2019. 

3. Investigation on the National Financial statement for the year 2018. Type of audit: 
compliance audit. Year Published: 2020. 


All audit reports, (legal) documents, internal documentations and other sources used, 
were in the Dutch language. When necessary, parts of the documents were translated?! 
so it can serve as evidence. The scoring sheets and final PMF report are in the English 
language. When finalized, the SAI will share the report internally. 

It is important to mention that for the selected sample reports, none of the three members 
of the SAI PMF assessment team were part of the same audit team. Also, to assess each 
audit work objectively, the assessment was based on all three team members’ opinions 
and judgment, and sufficient evidence was provided. 

The ownership of this assessment belongs to the Head of SAI'* Aruba. The Head of SAI 
will make all decisions about the use of the SAI PMF Report and its publication. 





° A quickscan audit is an investigation that does not contain recommendations and is carry out in a shorter time period. 

10 KPA stands for Aruba Police Force, KIA stands for Correction Institute Aruba and CEA stand for Special Forces Aruba. 

11 With the exception of the Constitution, the Google platform for translation and context.reverso.net was mainly used 
for translation. The Constitution has a formally translated version. 

” Head of SAI refers to all three members of the board. 
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2 SAI PMF Scoring Methodology 


The SAI PMF consists of six domains that assess the performance of SAI Aruba in key 


areas: 
. Independence and Legal Framework 

. Internal Governance and Ethics 

. Audit Quality and Reporting 

. Financial Management, Assets and Support Structures 


. Human Resources and Training 


"mono w > 


. Communication and Stakeholder Management 


Each of the domains contains several indicators, 25 in total. Each indicator consists of 
between two and four dimensions, which again may contain several criteria. An illustration 
of how the indicator system is built up is presented in diagram 1 below. 


Diagram 1. SAI PMF Terminology 






(A) Independence and Legal Framework 







(SAI-1) Independence of the SAI 







Tate |fer-\ cog 


Dimension (ii) Financial independence / autonomy 











(b) The SAI’s budget is approved by “the 


Criteria public body deciding on the national budget”. 





In many cases, the criteria are taken directly from the INTOSAI Framework of Professional 
Pronouncements (IFPP) or other international good practice. After each criteria is assessed 
against appropriate evidence and scored either met or not met, the score at the dimension 
and indicator level is aggregated using the SAI PMF document’s conversion tables. 


Indicators and dimensions are scored using a numerical scale from 0 to 4, where 0 is the 
lowest level and 4 is the highest. Scores broadly correspond to the level of development 
in the area measured by the indicator. The SAI PMF does not provide an aggregated score 
at the domain level or for the sum of the SAI’s activities like some other tools do. The 
level of development and hence the scores may vary widely across the SAI’s activities. 
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The indicator score levels 0-4 reflect the level of development for the different activities 
as described below: 


Score 0: The feature is not established or barely functions 


There is no activity or function, or the particular feature only exists in name. 


Score 1: The founding level 


The feature exists but is very basic. For example, a SAI is conducting performance audits, 
but these are so irregular that a systematic approach and accumulated experience and 
knowledge have not been obtained, and this is reflected in the quality of the work. 


Score 2: The development level 


The feature exists, and the SAI has begun developing and implementing relevant 
strategies and policies, but these are not complete and are not regularly implemented. 
For example, the SAI may have a strategic and development action plan, a human resource 
strategy, and a communications strategy. However, if these are weak and/or only partially 
implemented, this will be reflected in the score. 


Score 3: The established level 


The feature is functioning broadly as expected under the INTOSAI Principles and standards 
that are an equivalent of the ISSAIs at level 1-3 in the old ISSAI framework. Under Domain 
C, this would mean that compliance, financial, and performance audit are all undertaken 
broadly following the INTOSAI principles and standards equivalent to the ISSAIs at level 
3 in the old ISSAI framework. A large proportion of the financial statements received are 
subject to financial audits. Audit reports give a holistic view of the use of all public 
resources and on the audited bodies’ performance. The majority of audit reports are 
published in a format that is appropriate for the intended audience. 


Score 4: The managed level 


The feature is functioning following the INTOSAI principles and standards that are an 
equivalent of the ISSAIs at level 1-3 in the old ISSAI framework. The SAI implements the 
activities in a way that enables it to evaluate and continually improve its performance. For 
Domain C, compliance, financial, and performance audits are all undertaken following the 
INTOSAI principles and standards equivalent to the ISSAIs at level 1-3 in the old ISSAI 
framework, and are seen as adding value by audit clients. The SAI has also undertaken 
an independent review of its audit practices, for example, using the ISSAI Compliance 
Assessment Tool (iCAT), confirming that the SAI’s audit practices comply with the ISSAIs 
equivalent to level-4 ISSAI in the old framework. 


It is also important to point out that even with a top score, it should also be evident that 
the SAI is making efforts to maintain this level of performance. This could be described in 
the narrative and drawn into the performance analysis. 
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3 Country and SAI Background 


Information 


This chapter provides information about the country of Aruba and background information of 
their SAI. This information will serve the reader with a sufficient understanding of the wider 
context of the SAI’s performance and other core characteristics. 


3.1 Description of country governance arrangements and the 


wider environment in which the SAI operates 


Country context 

Aruba is an island located in the mid-south of the Caribbean Sea and is a constituent country of 
the Kingdom of the Netherlands. Together with Bonaire and Curacao, Aruba forms a group 
referred to as the ABC islands. Collectively, Aruba and the other Dutch islands in the Caribbean 
are often called the Dutch Caribbean. Aruba was formerly a part of the Netherlands Antilles. In 
1986 it became a separate self-governing part of the Kingdom of the Netherlands. The figure 


below gives a snapshot of some statistical figures for Aruba: 


Figure 1: Demographic snapshot of Aruba 


Demographic Snapshot — Aruba 
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Source: Central Bureau of Statistics Aruba, year 2010 
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Aruba has a small open economy with a pegged exchange rate to the U.S. dollar. Aruba is heavily 
dependent on the tourism sector, which can be classified as the main source of revenue for the 
island. Aruba’s economy has been gradually recovering from several recessions since 2008, with 
the latest recession caused by Covid-19, which had a huge impact on the tourism flow. 

The Covid-19 pandemic caused the government’s revenue to fall by Afl'?. 207.6 million to Afi. 
202.4 million in the second quarter of 2020, compared to the prior year. The following graph 
illustrates the revenues and expenditures volatility between 2019 and 2020. 


Figure 2: Revenue vs Expenditure in Afl. Million 
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Q1-2019 Q2-2019 Q3-2019 Q4-2019 Q1-2020 Q2-2020 
== Revenue 302.8 410 334.5 355.1 315.6 202.4 
@===Expenditure 338.8 355.7 362.8 332.2 342.4 504.1 


Source: Department of Finance; Tax Collector’s Office; Central Bank of Aruba. 

During the year 2019, Aruba had a slight financial recovery with a financial surplus of Afl. 54.1 
million in the second quarter of 2019. The surplus in 2019 turned to an Afl. 301.1 million deficit 
in the second quarter of 2020. By the end of June 2020, the government recorded Afl. 4,665.8 
million outstanding debt. The following graphic illustrates Aruba’s financial surplus and deficits 
between 2019 and 2020. 


Figure 3: Government Financial surplus Deficit (-) in Afl. million 
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Source: Department of Finance; Tax Collector’s Office; Central Bank of Aruba. 





3 Afl. is the Arubian florin (Aruba’s currency). Arubian Florin is equal to US $1.75. 
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Country governance and public financial management 


Aruba is a constituent country of the Kingdom of the Netherlands. Governance takes place 
as a framework of a Parliamentary representative democratic country, and a multi-party 
system, whereby the Governor is the head of the government. Aruba has full autonomy 
on most matters except defense, foreign affairs, and the Supreme Court. The Constitution 
of Aruba was enacted in 1986. 

As in many countries, Aruba also has the Trias Politica embedded in their Constitutional 
right. The Trias Politica is the philosophy that there has to be a strict separation between 


the three independent powers: legislative, executive, and judicial. 


The Parliament, in conjunction with the government (read: Governor and ministers), 
exercises the legislative power in Aruba. The government exercises the executive power. 
The judiciary is independent of the executive'* and the legislature. Therefore, the powers 
are not fully separated, as the government can execute the legislation made by 


themselves*». 


Although Aruba is a fully autonomous island, it has been since 2015 under the Netherlands’ 
supervision regarding financial matters. The Government of Aruba signed a protocol? with 
the Netherlands on a framework for achievement of sustainable public finances by 
monitoring the financial feasibility of the government budget. In 2015, this agreement 
was enforced by introducing a new legislation National Ordinance Aruba temporary 
financial supervision (LAft) and a body responsible for the financial supervision. In 2018, 
the Government of Aruba and the Netherlands signed another protocol for the period of 
2019-2021. This last protocol was established since the Government of Aruba did not meet 
the standards that were laid down by the LAft and, because Aruba had an unsustainable 
debt ratio. This protocol also created a framework towards solid, transparent and 
sustainable public finances and presents among others the new budget standards which 


were valid from 2019. 


Protocol Aruba Netherlands 2019-2021 

e Debt reduction; 

e Budgetary rules; 

° Change of LAft and supervision of the CAft?7; 

e Registration by the Netherlands on Aruba loans; 
Budget Board Aruba; 

e Auditor’s report; 

e Public Private Partnership (PPP) constructions. 





4 The executive: Government organizations, including departments of state (including Ministry of Finance), executive 
bodies, and agencies. 

15 Source: Book about the Constitution establishment of Aruba by P. Pronk; second edition Aruba 2000, page 46. 

16 Protocol 02 May 2015. 

17 CAft stands for the Dutch term College Aruba financieel toezicht (Board of financial supervision). 
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Each quarter the government reports to the Netherlands through the established 
supervision board?® on all updates regarding the financial position. The supervision board 
gives advice to the government or may take the necessary measures on financial matters. 
Aruba has a democratic system based on the Statute, that is derived to some extent from 
the Dutch laws. For instance, the freedom of the press, which is also guaranteed under 
the Dutch law. 

SAI Aruba noted that the new generation and part of the community, are in need of 
objective and transparent information. SAI Aruba’s independence and objectivity can 
contribute to the transparency and need for information regarding government revenues 


and expenditures. 


3.2 Description of public sector budgetary environment 
including public financial management and impact on SAI 


performance 


Since 1986, Aruba was given its Status Aparte, a form of independency. Aruba then 
became a constituent country within the Kingdom of the Netherlands. Therefore, the 
executive government consists of a Governor and the ministers. The Governor is formally 
appointed by the Dutch Kingdom and acts as a representative of the King in the 
Netherlands. The Council of minister consists of a prime minister - who provides the 
leadership for the council - and seven ministers, who may hold multiple portfolios and lead 
several ministries simultaneously. 

Parliament consists of 21 members elected by the public, and each one belongs to a 
political party or is independent. Parliament is led by a President and is supported by a 
secretariat led by a Registrar (in Dutch: Griffier). Parliament represents the public and is 


responsible for the supervision and control of the executive government 


Advisory bodies 

The Constitution of Aruba mentions the existence of advisory bodies, of which two are 
known in Aruba as the High Councils of State. These are the Advisory Council and the 
Court of Audit (Head of SAI). In 1987, the Social Economic Council was also established 
as a permanent advisory body, which is not a High council of State. The Advisory Council 
has an important role when establishing new legislation. The SAI examines the legality 
and effectiveness of the revenue and expenditures. The Social Economic Council advices 
the government on decisions that may have a social and economic impact. 

The government is not bound to follow the advisory bodies, advice but should not pass 
them just like that. All these advices should be made public. The figure below illustrates 
the structure of the advisory bodies. 


1® The Board of financial supervision Aruba (CAft) has a monitoring and advisory role. The board’s functions are 
focused on adopting and executing of budgets that are balanced within the agreed limits, and on the control of 
the totality of all loans. 
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Figure 4: Advisory bodies 
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Financial and accountancy government department 

The Department of Finance conducts all financial management activities and transactions 
of the Government of Aruba. The Department of Finance is responsible for advising on the 
financial-economic field and monitoring the public finances on behalf of the Minister of 
Finance. The Department of Finance has the task of compiling the national financial 
statement and managing the policy cycle, and the budgetary cycle. 

The Central Government Accountancy Department, known as the CAD!9, supports the 
Department of Finance to the extent of their capacity, as they have been confronting staff 
shortage for many years. SAI Aruba may use the work carried out by the CAD as input for 
their investigations after conducting the necessary reviews. 

After the Department of Finance compiles the national financial statement, it is sent to 
the CAD, who examines whether the national financial statement of Aruba have been 
derived from or is consistent with the central financial administration. The CAD does not 
carry out an audit nor provides a review report on the national financial statement. The 
main reason for not exercising these tasks is the absence of a prescribed model (financial 
framework) for the annual accounts layout. Aruba’s national financial statement is 
compiled according to the Compliance Regulation 1989. 

The Department of Finance uses a "mix" of valuation principles for the national financial 
statement at random. Often these (partially) deviate from the principles of generally 
accepted annual reporting systems. It is, therefore, not possible to conduct an audit on 
this basis. There are also no objective/established standards against which can be used 


for conducting the audit. 


Budget process 

The Department of Finance is also responsible for preparing the annual budget for Aruba’s 
public departments, except for Parliament, the SAI, and the Advisory Council. These 
institutions have a separate budget and prepare their own budget draft. 

The final draft of the budget is sent to the Minister of Finance*°. The annual budget is 


compile based on the policies and plans of these institutions. The budget process starts at 


19 CAD stands for the Dutch term Centrale Accountantsdienst. 
20 The final draft of the budget of the SAI, Parliament and the Advisory Council is sent to the Parliament, where it is 
treated in a public meeting. 
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the beginning of the prior year. In general, the budget follows the policies and plans of 
the government. At the beginning of the year, each department submits an estimated 
amount (within the established margins) together with the necessary information and 
explanation of their plans. 

The Department of Finance compiles all the data and continues with the process of 
developing a budget draft that is discussed with the budget coordinators from each 
ministry department. 

The final draft of the budget is sent to the Minister of Finance, who, in turn, sends it to 
the CAft. After review, the comments and advice of the supervision board are incorporated 
into the budget. The budget is then sent to the Council of Ministers and afterward to the 
Advisory Council for further observations. After going through these processes, the budget 
is submitted to Parliament and treated in a public meeting. The approved budget is then 
transformed into a legislation that is signed by the Governor. 


PEFA Self-assessment?! 

In 2015, a self-assessment was performed and carried out by the Government of Aruba 
on the advice of CAft and was based on a Public Expenditure and Financial Accountability 
(PEFA) measurement of Aruba’s financial management. The self-assessment was carried 
out based on the PEFA framework of 2011. The objective of the baseline measurement 
was to map the current situation on the financial management of Aruba. 
The PEFA framework consisted of 28 performance indicators, from which a few were 
directly or indirectly linked with the work of the SAI. The performance indicators with their 


scores and findings are presented below. 


PI-19 (P1- 24): Competition, value for money and controls in procurement - Score C+ 





To be transparent, complete, and competitive in the tendering procedures, the regulations 
must meet six criteria. Aruba met four of this six criteria. 
Although the procedure is in accordance with the Compliance Regulation 1989, there is 
some room for improvement in accordance with current regulations. The public 
procurement system, as such, functions reasonably well in Aruba. The tendering plan and 
the offer options, are made public. Information about the procedure is also public. 
However, information regarding the award was not made publicly available. 
There is existence of an independent administrative body where complaints can be lodged 


in public procurement. 


PI-21 (PI-24): Effectiveness of Internal audit - Score D+ 





Due to both qualitative and quantitative limitations in the CAD, there is no regular, 
extensive, and in-depth audit of key central processes. On the other hand, checks 
performance by the CAD is in accordance with professional audit standards. All reports of 
the CAD’s general audits are sent in accordance with procedures to all internal 
stakeholders within the government. According to the CAD, little or no action is taken with 


the recommendations for improvements included in the audit reports. 





21 Inventory PEFA self-assessment financial management Aruba, July 2015. 
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PI-25 (PI-29): Quality and timeliness of annual financial statements. - Score D+ 





Not all financial information is included in the financial statements. The omissions in the 
field of administrative organization/internal controls and the lack of clear, acceptable 
standards frameworks are reasons for not being able to subject the financial statement as 
a whole, to an audit. The financial statement is prepared in accordance with the 
Compliance Regulation 1989. It is not clear from the Compliance Regulation 1989, which 
basis of valuation and result determination should be applied. 

The CAD reconciles the national financial statement and the financial administration. The 
mutual connections and consistency are also assessed. An IT audit of the systems is 
considered necessary to gain insight into the reliability of the costs and revenues as 
included in the systems. The National Financial statements of the years 2013 and 2014 
were not within the legal term in accordance with the Compliance Regulation 1989. Both 
national financial statements were submitted within 10 months after the end of the 


financial year. 


PI-26 (PI-30): Scope, nature and follow-up of external audit - Score D+ 





Due to shortcomings in the financial management and the qualitative and quantitative 
capacity of the control institution, an audit on Aruba’s national financial statement is not 
possible in the short term. The SAI does not carry out an financial audit on the national 
financial statement of Aruba. The National Financial statement from 2013 was assessed 
within the statutory period of 12 weeks, and presented to the Minister of Finance and 
Parliament. In various areas, SAI Aruba gives recommendations in its reports. However, 


there is little or no follow-up being done by Parliament. 


PI- 28 (PI-31): Legislative scrutiny of external audit reports - Score D+ 





Due to the delayed delivery of the financial reports before 2013, the timely handling of 
the financial reports by Parliament has not been done. In Aruba, there is still no structural 
and in-depth handling of essential findings of Parliament. The depth in the Parliament's 
handling of the investigation report on the National Financial statement of 2013 shows a 
major development. After considering of the SAI reports, the Parliament may make follow- 
up recommendations to the Council of Ministers. Since mid-2014, a more active role of 
Parliament can be assumed when it comes to monitoring the government. The minister is 


more often asked to answer at a public/central session. 


Transparency budget process — Score B 





All information regarding the approved legislation regarding the budget is made public, 
and all citizens can follow the live debates meeting on TV. All government financial 
operation reports are available on the website of the Central Bank of Aruba. Changes in 
the budget are also available on the website of Parliament. However, their annual report 
is not published within 6 months after completion. All tenders according to the legislation 


are made public. The award is not public, but is available on request. 
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3.3 Description of the SAI’s legal and institutional framework, 


organizational structure and resources 


Legal and institutional framework 

SAI Aruba is based on the principles of the Westminster model for SAI’s. The position of 
the SAI is anchored in the Constitution of Aruba - AB 1987 no. GT 1 - and further 
elaborated in the National Ordinance Court of Audit Aruba?*. SAI Aruba is an independent 
supervisory body responsible for examining the legality and effectiveness of the revenue, 
and expenditure of the country of Aruba. This applies to all public entities and all bodies 


(organizations) in which the government has a financial interest. 


SAI Aruba is a High Council of State and is set up to be an independent institution, separate 
from the government and Parliament. The foundation of its tasks is established in the 
Aruban Constitution. SAI Aruba has statutory powers to perform the work according to 
article IV.5 of the Constitution of Aruba. Independent means that the SAI is free to choose 
research subjects, and determine how the investigations are carried out and how they are 
reported. SAI Aruba is also empowered to carry out investigations in institutions, 
associations, corporations, public limited liability companies, foundations, or other bodies 
in the benefit of subsidies to the government or the management of funds and goods 


provided by the Government of Aruba??. 


The Head of SAI Aruba consists of three members, including a chairman. In addition to 
the three members, two alternate members must be appointed. The Head of SAI makes 
the decisions about working methodologies and audit approaches of the SAI by a majority 
vote. Decisions are made in the presence of a Secretary-General. The Constitution of 
Aruba states that SAI Aruba should conduct compliance and performance audits on the 
revenues and expenditures of the Government of Aruba. The National Ordinance explains 
further that the SAI investigates and supervises the country’s national financial statement 
and the public entities. The audit findings are reported to Parliament?*, after which the 


reports are made public to the general public. 


Organizational structure 

SAI Aruba is centralized in the capital city of Oranjestad, where it has its office facility. It 
has no sub-national offices. The Head of SAI leads the SAI. The Head of SAI is supported 
by a Secretary-General and staff members who are appointed to the secretariat. The 
secretariat of SAI Aruba are appointed as civil servants. The organization and legislation 


of SAI Aruba are set out in the National Ordinance Court of Audit Aruba. 





22 The term National Ordinance Court of Audit Aruba will be used throughout the report to refer to the National Ordinance 
Court of Audit of Aruba. A National Ordinance is a form of legislation. The law is passed jointly by the government and 
Parliament. 

23 National Ordinance Court of Audit Aruba article 31.1. 

74 National Ordinance Court of Audit Aruba article 24.a. 
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SAI Aruba has the following organizational chart (Source: Strategic Policy plan 2019- 
2022): 


Figure 5: SAT Aruba organizational chart 


Aruban Court of Audit 
(3 members) 


SecretaryGeneral 
Policy department Operations department 


Research department 


Court of audit?®: the Court of Audit consists of three members, including a chairman. This 
court is the Head of SAI. Currently, the chairman’s position is vacant, and one of the 
members is currently filling the position of acting chairman for the last six years. Members 
of the Head of SAI are appointed for life. Decisions are made based on the collegial 
decision-making principle. This means that the members of the Head of SAI take all 
decisions jointly. Each member of the Head of SAI also acts as a co-rapporteur during the 
staff’s audit work (research department). The chairman oversees the organization as a 


whole. 


Secretary-General: the Secretary-General is head of the secretariat (SAI staff) and is 
responsible for its daily operations, such as personnel, finances, and organizational 
operations. The Secretary-General is accountable to the Head of SAI. The Secretary- 
General provides substantiated management information to the Head of SAI on the 
functioning of the secretariat. The Secretary-General also advises the Head of SAI on the 
quality aspects of the audit. 

The Secretary-General supports the Head of SAI in its work, amongst others, by preparing 
decisions and taking part in the periodic board meetings. Externally, the Secretary- 
General, in addition to the Head of SAI, has an important role. The Secretary-General 
regularly consults with his official "counterparts": departments and leaders of institutions, 
where SAI Aruba has audit powers. Important discussion partners are, amongst others, 
the director of the Department of Finance, director of the CAD, the Registrar of Parliament, 
and officials of the Minister of General Affairs. 


Policy department: the policy department is in charge of drawing up policy advice, 
budgets, annual reports, notes, etc. This department has never been operational, and the 
function within this department are vacant. Currently the Secretary-General and some 


auditors are doing these tasks. 





25 The legislation speaks about the Court of Audit Aruba which is the Head of SAI. 
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Operations department: the operations department is responsible for the administrative 
support of the Head of SAI, the Secretary-General, and the staff. The operation staff is 
also responsible for the financial administration, IT, archive, and domestic services. The 
operation team currently consists of three employees, and there is a vacant position for a 
head of Operations. 


Research department: In consultation with the project manager, the Secretary-General 
sets up an audit team for each investigation. The project manager reports directly to the 
Head of SAI about the implementation, planning, and content of the research and the 
relationships with the audited organizational units. The project manager within the 
research team ensures for effective and efficient work distribution. The research 
department currently consists of six employees. 

The research department have had a shortage of staff for years. Currently, there are 
vacant positions for three project-leaders and three researchers (50% vacant). 


The SAI’s resources 


The table below presents a summary of the provisional?® figures on the expenditures and 
approved budget for the year of 2019. 


Table 3: Realized expenditures for 201927 





Budget Under and 
Approved (over) 
2019 expenditure 


Expenditures 


Category 2019 


COSTS (in Afl. 28) 


Salary and social cost 990.601 1.281.000 290.399 
Employer’s contribution 240.299 307.400 


Transfers to governments and 1.865 5.000 3.135 
international institutions a i 
Settlement, contributions and 133.994 134.000 

depreciation L 4 


TOTAL 2.228.213 2.620.000 


The table shows that the expenses did not surpass the budget for a total of Afl. 391.787 
or 15%. All salaries and employees’ contribution (4100-4200) is nearly 55% of the total 
budget. Goods and services (4300) was 38% of the total budget, from which 37% was 


spent on the premises’ rent. 


26 These figures are aligned with the Department of Finance but are subject to change, as the 2019 financial year has 
not yet been finalized by the Department of Finance as of 10 July 2020. 
27 Annual report 2019. 
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4 Assessment of the SAI’s 


Performance 


This chapter aims to provide an assessment of the key elements of SAI’s performance, as 
measured by the indicators. Low scores will highlight opportunities for improvement, 
whereas high scores will be a sign of good practices. 


4.1 Domain A: Independence and Legal Framework 


Domain A covers the legal mandate of the SAI and its independence. The purpose of the 
domain is to consider the institutional basis for the SAI’s operations, to understand how 
SAI Aruba performs as an organization. The SAI’s independence and legal framework are 
not directly under the control of the SAI, but the domain has nevertheless been included 
in the SAI PMF, because the SAI’s independence and legal framework significantly 
contributes to its effectiveness. 


The following table provides an overview of the scores. Section 4.1.1 and 4.1.2 provide 
further details. 


Domain A: Independence and legal framework 


Indicator Name 


Independence of the SAI 























Mandate of the SAI 








4.1.1 SAI-1: Independence of the SAI - Score 2 

SAI-1 measures the degree of independence enjoyed by the SAI by assessing the key 
aspects of independence, as set out in the Lima Declaration (ISSAI 1) and the Mexico 
Declaration (ISSAI 10). 


The indicator is separated into four dimensions: 


(i) Appropriate and Effective Constitutional Framework 
(ii) Financial Independence/Autonomy 
(iii) Organizational Independence/Autonomy 


(iv) Independence of the Head of SAI and its Officials 
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The assessment of SAI-1 was mainly based on the Constitution of Aruba, established in 
1987 (AB 1987 no. GT 1), National Ordinance Court of Audit Aruba, established in 1998 
(AB 1998 no. GT 20), and the Compliance Regulation established in 1989 (AB 1989 no. 
72). 


Dimension (i): Appropriate and Effective Constitutional Framework 


The establishment of SAI Aruba is laid down in the Constitution of Aruba. Article IV.5 
states that: “The Court of Audit shall be appointed with the examination of the 
effectiveness and legality of the Land’s revenues and expenditures.” 

The Constitution of Aruba regulates the Court of Audit’s duties, and it states that further 
elaboration on the structure and powers may be set out in the legislation, which is the 
National Ordinance Court of Audit Aruba. Article IV.7 states that: "The organization and 
powers by the Court of Audit shall be regulated by National Ordinance.” 


SAI Aruba’s Independence in legislation 

The Constitution of Aruba does not explicitly state that SAI Aruba is an independent 
organization. The explanatory memorandum of the Constitution of Aruba states that the 
term ‘independent institution’ was not explicitly used in order to be consistent with the 
common language. However, the independence of the SAI can be found throughout the 
interpretation of the legislation articles. For instance, the explanatory memorandum of 
article IV.6 of the Constitution of Aruba states that the Head of SAI's independence is 
necessary for the proper fulfilment of their positions and are therefore appointed for life. 
In both the Constitution of Aruba and the National Ordinance Court of Audit, the 
appointment, term, cessation of functions of the chairman and the members of the Head 
of SAI, and the independence of their decision-making powers are guaranteed. However, 
both of these laws do not cover adequate legal protection by a Supreme Court against any 


interference with the SAI’s independence. 


The Constitution of Aruba and the National Ordinance Court of Audit Aruba also does not 
state that the SAI has a high degree of initiative and autonomy, as it is advised by ISSAI 
1. SAI Aruba’s initiative and autonomy relate to the aspects of having their own budget to 
operate. Each year the SAI submits the initiative law of Parliament on its budget after 
consultation with the Minister of General Affairs. The budget is offered to Parliament in 
the form of a National Ordinance draft. The SAI's budget is then addressed by Parliament 
and approved. The rights of preparing their own budget and offering as an initiative give 


SAI Aruba some level of independence and autonomy. 


The Constitution of Aruba and legislation also does not specifically state that SAI Aruba 
should report on any matter that may affect their work according to their mandate. In 
practice, however, SAI Aruba can refer to article 27 of the National Ordinance Court of 
Audit Aruba, which states that the SAI can submit an annual report. In the annual reports, 
the SAI has the possibility to report on any matter that may affect its ability to perform 
in accordance with its mandate. In the Annual report 2019, the SAI reported of the delayed 
publication of the investigation on the National Financial statement 2018. 
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Since 1999 the Head of SAI has been advocating towards updating and modernizing the 
necessary legislations that ensure the required independence and autonomy. SAI Aruba, 
together with an external party have been working on a proposal to update and modernize 
the National Ordinance Court of Audit Aruba. The acting chairman of the Head of SAI and 
the (acting) Secretary-General also participated in a commission that had as objective the 
modernization of the legislations for the High Council of the State, which includes the SAI. 
There has been, however, limited progress on the matter so far, other than the approval 
of a National Ordinance of the Ombudsman by the Legislator. This law is not in effect yet. 


Dimension (ii): Financial Independence/ Autonomy 


As was mentioned earlier, the legal framework does not specifically mention SAI Aruba's 
independence; this is also the case to the SAI’s financial independence. The SAI has the 
right to manage and propose an initiative for their budget. However, the proposed budget, 
must remain within the margins indicated in the draft budget of the Ministry of General 
Affairs and may not exceed the approved budget of the year before. Thus there is, to some 
extent, interference from the executive when the SAI proposes its budget. But, this 
interference has to do with, amongst others, the protocol that Aruba signed in 2018 with 
the Netherlands, which included a budget policy for cutbacks within the ministries. 

SAI Aruba can, however, use the funds as they see fit, but need to follow the legislation's 
rules - Compliance Regulation 1989. For instance, the law states that expenses between 
Afl. 10.000, and Afl. 100.000 can go through a private tender, whereas expenses that 
surpass Afl. 100.000 needs to go through a public tender. 


Budget approval process 

A National Ordinance approves the SAI’s budget. Article V.12 of the Constitution states 
that the national budget is established by National Ordinance. Article V.1 of the 
Constitution states that the National Ordinance is passed jointly by the government and 
the Parliament, being the legislator. For the budget to be approved, the National Ordinance 
is approved by Parliament and ratified by the Governor (Article V.2 of the Constitution). 
From these two articles, we can conclude that the Parliament approves the SAI’s budget. 
It is, however, proposed and established separately from the national budget. Once the 
budget is approved by National Ordinance, the Minister of Finance oversees the national 
funds’ spending. In the years under review, there has been no cases of interference from 
the executive. 

In case there are insufficient funds, the SAI can request extra funds to be obtained by a 
supplementary budget by National Ordinance. There is also a legislation?? that gives SAI 
Aruba the right to appeal on the provided resources/budget. 


Dimension (iii): Organizational Independence 
The legal framework ensures that the SAI has the functional and organizational 
independence required to accomplish its tasks. Article IV.5 of the Constitution of Aruba 


regulates the organizational independence and states that: 





2° Arrangement for other financial administration article 6. 
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“The Court of Audit shall be in charged with the examination of the efficiency and 


legality of the Land’s revenues and expenditures.” 


The National Ordinance Court of Audit Aruba art. 4 regulates the SAI's functional (Head of 
SAI) independence. Article 4 of the National Ordinance Court of Audit Aruba states 
that: “The members and the Secretary-General may not hold any other positions if 
these positions are inappropriate considering the proper performance of their 
professional duties or with the maintenance of their impartiality and independence, or 


of trust therein.” 


Even though the SAI’s organizational independence is covered by law, in practice, the 
Head of SAI needs to inform the minister or ask for approval on certain organization and 
management matters, such as the fulfilling of vacancies, hiring of staff, and the signing 
of contracts. 

When asking for approval on certain organizational matters, the minister or executive may 
delay the process, which impacts the management of the institute. For instance, the Head 
of SAI does not currently have a chairman that is formally appointed. The SAI had sent 
numerous follow-up letters to Parliament, and up to this date, Parliament has not decided 
on the Chairman’s position. Also, the difference in remuneration for the acting chairman 
has for more than six years not been paid out. This is to be decided by the Minister of 
General Affairs. 


Although the SAI can determine its own rules and procedures through a National 
Ordinance, the SAI is still dependent on the Minister of General Affairs. The National 
Ordinance Court of Audit Aruba does not state its financial independence, which is 
necessary to manage the organization properly and fulfill the SAI’s mandate. For certain 
financial obligations, the SAI has to follow the same procedures (approval of the minister) 
as other government entities, such as the closing of contracts with a third party. 

The Head of SAI also does not have the freedom to decide on human resource matters 
independently. The National Ordinance Court of Audit Aruba states that the SAI’s 
personnel is formally appointed, suspended, and discharged by the Governor. In practice, 
however, the Head of SAI can decide which candidate they will nominate to be formally 
appointed, but the Ministers of General Affairs decides on the appointment of the 
nominated candidate. Employees of SAI Aruba have a government functionary status; 
therefore, their rights are stipulated on the National Ordinance of Civil Service, which 
applies to all public workers. 

If required, the SAI is entitled to call on and pay for external expertise as necessary. The 
National Ordinance Court of Audit Aruba allows the SAI to be assisted by experts when 


necessary. 


The relationship between the SAI and the ministers is not defined in the Constitution or 
the National Ordinance Court of Audit Aruba. The Constitution states that the SAI is 
responsible for examining efficiency and legality of revenue and expenditure. The 
recommendations that the SAI provides are aimed at improving the _ financial 


administration of Aruba. Therefore, the government should embrace all advice provided 
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by the SAI. The legislature does not state further the relationship between the SAI and 


the ministers. 


The SAI’s accountability and transparency are covered in article 27 of the National 
Ordinance Court of Audit Aruba, which states that the SAI needs to report on its activities 
from the past year before the 1st of April of each year to the Governor and by the ist of 
May to the Parliament. According to the legislature (article 24a.2 of the National Ordinance 
Court of Audit Aruba), all reports submitted to Parliament are made public. Once the 
annual report is made public, the annual report is published on the SAI’s website to 
contribute to the organization’s transparency. In the annual report, the SAI provides 
accountability for the activities of the prior year. 


Dimension (iv): Independence of the Head of the SAI and its members 


The condition for appointment and removal of the Head of SAI members is specified in the 
National Ordinance Court of Audit Aruba. Article 3 - 5 of the National Ordinance specify 
some of the conditions for appointment of the members of the Court of Audit (Head of 
SAI), these are among others; 

° May not be related by blood to one another to the second degree. 

e May not be related to any other public office to which a fixed remuneration, an allowance, 
or attendance fee is payable by the Government or by an institution created by or according 
to statutory regulations. 

e May not hold any other positions of which the exercise is undesirable with a view to the 
proper fulfillment of their office or the maintenance of their impartiality and independence 
or confidence in them. 


° Must have Dutch citizenship and have completed the age of thirty and resides in Aruba. 


Procedure for an appointment 

When there is an open position, a job announcement is published in the local newspapers. 
After gathering all applications, the selection of the potential candidates is made internally 
by the sitting members of the Head of SAI and the Secretary-General. After the selection 
is made, a list of three potential candidates is made and sent to Parliament for approval. 


The Constitution states that the chairman and other members of the Head of SAI are 
appointed for life by National Ordinance, nominated from a list of at least two persons 
drawn up by the Parliament. The Head of SAI sends a recommendation list to Parliament 
that includes the potential candidates that can fulfill the open positions. Parliament shall 
consider this list (without the obligation to choose from the list) in their appointment for 
a new member for the Head of SAI. 

In the Constitution it is settled that the Court of Justice can discharge the members of the 
Court of Audit (Head of SAI). However, the National Ordinance Court of Audit Aruba states 
that the Governor can appoint and dismiss the members of the Court of Audit and under 
which conditions. In article 6 the condition for discharge are mentioned and these are, 
among others: 

e “at own request, 


° when they have been convicted of a crime, 
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e when they have been declared bankrupt, have been granted a moratorium on payments, or 
have been held for debt?°, and 


e when they are placed in receivership.” 


The Governor can grant resignation to the members of the Head of SAI when: 


e They are unable to perform their duties properly due to persistent illness or because of age 


deficits. 


° For misconduct or immorality or proven continuous negligence in the performance of their 


Office. 


° They have acted contrary to Article 9 of the National Ordinance Court of Audit Aruba. 


In the last three years, there have been no cases that members of the Head of SAI Aruba 


were removed through an unlawful act or in a way that compromised the SAI’s 


independence. 


Assessment Findings and Observations 


Dimension 


(i) Appropriate and 
effective 
Constitutional and 


Legal Framework 


(ii) Financial 
Independence/ 
Autonomy 


(iii) Organizational 


Independence/ 


Autonomy 














Findings Score | 
Criteria a, b, d, f, and g have been met. 3 
Criteria c and e have not been met. 
The establishment, appointment, term, cessation of functions of the SAI and 
the Head of SAI are set out in the Constitution. The independence of the SAI 
is interpreted throughout the legislation articles. 
Neither the Constitution and the National Ordinance state that the SAI has any 
form of legal protection by a Supreme Court against any interference. 
Criteria b, d, f, and g have been met. 1 
Criteria a, c and e have not been met. 
The legal framework does not states SAI Aruba's (financial) independence. The 
Parliament approves the SAI’s budget. Once the budget is approved by 
National Ordinance, the Minister of Finance oversees the national funds’ 
spending. In case there are insufficient funds, the SAI can request extra funds 
to be obtained by a supplementary budget by National Ordinance. The 
arrangement for other financial administration gives SAI Aruba the right to 
appeal on the provided resources/budget. 
Criteria a, f, and g have been met. 2 
Criteria b, c, d, and e have not been met. 
In practice SAI Aruba needs to inform the minister or ask for approval on 
certain organization and management matters, such as the fulfilling of 
vacancies and hiring of staff. The Head of SAI is not free to independently 
decide on all human resource matters. Currently, the SAI does not have an 
appointed chairman. 
Criteria a, b, e, f, and g have been met. 3 
Criteria c and d have not been met. 








°° The legislation states that the audit staff shall not have any debt claims or act as collateral at any organization with a 
contract with Aruba’s government. This article intends to avoid any influence or dependency from the audited 
organization on the audit staff. 
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Dimension Findings 


(iv) Independence The National Ordinance specifies the conditions for appointment and discharge 


of the Head of the of the member of the Head of SAI. The last appointment of a member of the 
SAI and its officials Head of SAI was done through a transparent process that ensured their 


independence. 








4.1.2 SAI-2: Mandate of the SAI - Score 3 


SAI-2 aims to assess the width of the SAI’s mandate in terms of the scope and nature of 
the duties and responsibilities of the Head of SAI and staff members as well as the SAI’s 
ability to access all information required to fulfill its functions and its right and obligation 
to report. 


The indicator has three dimensions: 
(i) Sufficiently Broad Mandate. 
(ii) Access to Information. 

(iii) Right and Obligation to Report. 


The assessment of SAI-2 is mainly based on the Constitution of Aruba, established in 1987 
(AB 1987 no. GT 1), National Ordinance Court of Audit Aruba established in 1998 (AB 1998 
no. GT 20) and, Compliance Regulation established in 1989 (AB 1989 no. 72). 


Dimension (i): Sufficiently Broad Mandate 


All public financial operations are subject to audit by SAI according article 31 of the 
National Ordinance Court of Audit Aruba: 
"Any institution, association, corporation, limited liability company, foundation or other 
entity benefiting from a subsidy from the national budget or managing funds or goods 
provided by the national budget is obliged to submit periodic overviews of the entire 
financial management and the assets and liabilities to the Court of Audit upon its first 
claim within the prescribed period". 


The National Ordinance Court of Audit Aruba specifically prescribes that the SAI is 
responsible for the investigation of all government activities. Article 24 of the National 
Ordinance Court of Audit Aruba states: 
"The Court of Audit examines whether the financial statement of the state...the financial 
statement of the government companies.....companies and institutions with legal 
personality established by National Ordinance ...... and from the budget funds......contain 
all articles that must appear according to the regulations". 


In addition to the National Ordinance Court of Audit Aruba, the Constitution of Aruba states 
that the SAI is responsible for investigating the efficiency and legality of the State's 
revenues and expenditures. This is according to article IV.5 of the Constitution of Aruba. 
The SAI is free from direction and interference in selecting audit issues, planning, conduct, 
reporting, and follow-up of their audit. In the intro of the explanatory memorandum of the 
National Ordinance Court of Audit Aruba, it is stated that the SAI is not in any way 
dependent on the executive. It states that independence is anchored in numerous of the 


SAI Performance report of SAI Aruba 


articles of the National Ordinance Court of Audit Aruba. In practice, the SAI has the 
freedom to select the audit types, how they plan their audits, and the reporting. The Head 
of SAI approves the annual audit plan and each audit without any interference. In the past 
three years, the SAI has not been given or taken any tasks that may influence its 
mandate's independence. The Parliament can request a specific audit, but the Head of SAI 
decides whereas to conduct the audit and in what capacity. Also, there was no evidence 
that there have been cases of interference in the SAI's selection of audit clients or subjects 


in the last three years. 


According to the National Ordinance Court of Audit Aruba, the SAI is empowered to 

investigate the following: 

e legality and regularity of government or public entities accounts (article 4.1c National 
Ordinance Court of Audit Aruba); 

e quality of financial management and reporting (article 1 National Ordinance Court of Audit 
Aruba); 

e economy, efficiency, and effectiveness of government or public entities’ operations (article 
24.2 National Ordinance Court of Audit Aruba and article IV.5 Constitution). 


Dimension (ii): Access to Information 


The National Ordinance Court of Audit Aruba (article 33.1) provides the SAI with 
unrestricted right: 
“...to obtain information and the intake of cash and supplies, as well as to carry out 
the examination of books, accounts, accountability, supporting documents, and other 
documents that it deems necessary for the performance of the task, assigned to her 


by this National Ordinance”. 


The SAI also has the right to decide which information it needs for its audit, based on 
article 33 of the National Ordinance Court of Audit Aruba. The article also mentions that 
the SAI can collect information on the registered cash and supplies, examine accounts, 
accountability, evidence, supporting documents, and examine other documents that it 
deems necessary for the task’s performance. Article 23 of the same National Ordinance 
states that each department must send overviews to the SAI, that deemed necessary for 
fulfilling the SAI’s mandate. The SAI decides on the format and terms after consultation 
with the Minister of Finance. Also, article 33.3 of the National Ordinance Court of Audit 
Aruba states that all persons working in the public sector and government of the entities, 
which are entitled to the administration of entities, should provide information to the SAI 
within the period set by the SAI. 


If access to the information required for the audit is restricted or denied, the SAI has the 
right to notify the responsible minister. The minister should take the necessary measures 
to ensure that the information required is submitted. This process for resolving matters is 
according to article 19 of the National Ordinance Court of Audit Aruba. The National 
Ordinance Court of Audit Aruba also states that the SAI staff have the right to access the 
premises of audited bodies to do the fieldwork. 
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Dimension (iii) Right and Obligation to Report 

The SAI is not empowered and required by the Constitution to report its findings annually 
and independently to Parliament. However, the Constitution states that the SAI can further 
specify its powers in the National Ordinance Court of Audit Aruba. In the National 
Ordinance Court of Audit Aruba, article 27, prescribes that the SAI reports to the Governor 
on its work in the annual report, which is afterward presented to Parliament. After 
Parliament receives the annual report, the report is made public, according to article 24a.2 
of the National Ordinance Court of Audit Aruba. 


The SAI is empowered to report on essential and significant findings during the year. The 
National Ordinance Court of Audit Aruba, article 28 and 29, states that the SAI has an 
obligation to report its findings to the Council of Ministers and is authorized to report to 
the Governor and Parliament all findings that the SAI considers in the interest of the 


general public. 


The SAI is free to decide the content of its audit reports. The National Ordinance Court of 
Audit Aruba does not state that the SAI is restrained on its audit reports' content. 
However, according to the National Ordinance Court of Audit Aruba, article 14a.1, states 
that the SAT is not free to report findings that may implicate national security. Any findings 
regarding national security should be presented to the national security commission, who, 
in turn, will decide which findings can/cannot be published. 


As the SAI is free to decide on its audit reports' content, the SAI is also free to decide on 
its reports' timing, with exception the audit on the national financial statement. For this 
report the SAI needs to comply with a time frame that is included in article 44 of the 


Compliance Regulation 1989. 


There has been no interference in the SAI's decisions on its audit report content during 
the past three years. However, there has been interference in the SAI's efforts to publish 
its audit reports in the past three years. In 2017 the SAI was not able to publish any 
report, because the Head of SAI consisted of only one member, and therefore the acting 
chairman was not able to make any legal decisions. 


Assessment Findings and Observations 


Dimension Findings 









Criteria a, c, d, e, f, g, h, and i have been met. 
(i) Sufficiently Criteria b is not applicable. 

Broad Mandate 

According to the SAI’s mandate, the SAI should investigate all public 
financial operations. The SAI also has the responsibility to audit all 
government activities. The SAI is independent in the choice of audit 
issues, in its audit planning and in the conduct of its audits. During the 
past three years, SAI Aruba has not taken any tasks, which influence the 
independence of its mandate. Also within the last three years, there have 
been no cases of interference in the SAI’s selection of audit clients or 
subjects. The SAI is empowered to investigate the efficiency and legality 


of revenue and expenditure. 
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Dimension Findings Score 
Criteria a, b, c, and e have been met. 4 
(ii) Access to Criteria d is not applicable. 

Information 

The National Ordinance Court of Audit Aruba provides the SAI with 
unrestricted right of access to record, documents and information. The 
SAI also has the right to decide which information it needs for its audits. 
In case the access to information required for the audit is restricted or 
denied, there is an established and appropriate process for resolving such 
matters. 


According to the National Ordinance Court of Audit Aruba the SAI staff 
has the right to access to the premises of audited bodies in order to do 
the fieldwork the SAI deems necessary if necessary with assistance of law 


enforcement. 





Criteria b, c, d, e, and f have been met. 2 
(iii) Right and Criteria a, and g not met. 


Co} s)iferhdtela mice) 


Report According with the National Ordinance Court of Audit Aruba, the SAI has 
the right to publish its annual audit reports. The SAI is also empower to 
report on particularly important and significant findings during the year 
and is free to decide on the content of its reports. The SAI is free to 
decide the timing of its reports except where specific requirements are 
prescribed in law. During the past three years, there has been no 
interference in the SAI’s decisions on the content of its audit report. 


SAI Aruba is not empowered and not required by the Constitution to 
report its findings annually and independently to Parliament. During the 
past three years, there has been interference in the SAI’s efforts to 
publish its audit reports. 











4.2 Domain B: Internal Governance and Ethics 


This domain measures the SAI’s overall performance in the area of internal governance 
and ethics. 

Domain B seeks to assess whether the SAI manages its own affairs effectively and through 
good governance, setting an appropriate example to others. Domain B has five indicators. 
The following table provides an overview of the scores in the five indicators of domain B. 
Section 4.2.1 till 4.2.5 provides further details for each indicator. 


Domain B: Internal Governance and Ethics Dimensions 


Indicator Name 

















Strategic Planning Cycle 
SAI-4 Organizational Control Environment 0 0 1 0 [a 
SAI-5 Outsourced Audits N/A | N/A | N/A N/A 
SAI-6 Leadership and Internal Communication 2 3 2 
SAI-7 Overall Audit Planning 1 2 1 
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4.2.1 SAI-3: Strategic Planning Cycle -— Score 1 

Strategic planning is a vital component of any SAI to ensure that the organization has a 
clear direction and vision and a properly thought out plan to deliver it. SAI-3 stresses the 
importance for a SAI of having a strategic planning process to ensure that the vision can 
be transformed into reality in a coherent and logical manner. Strategic plans need to be 
supplemented with annual operational plans that will transform strategic visions and 
aspirations into operational and institutional reality. 


This indicator has four dimensions: 


(i) Content of the Strategic Plan. 

(ii) Content of the Annual/Operational Plan. 

(iii) Organizational Planning Process (Development of Strategic Plan and Annual/Operational 
Plan). 

(iv) Monitoring and Performance Reporting. 


The assessment of SAI-3 is based on a review of the SAI’s current Strategic Policy plan 
2019-2022 and an annual/operational plan. 


Dimension (i): Content of the Strategic Plan 


The current Strategic Policy plan 2019-2022 was developed through internal staff 
consultations, led by the acting chairman and an external consultancy party. The strategic 
policy plan was finalized in July 2019 and made public in the same year. 


The strategic policy plan includes a strategic triangle (fig. 6) consisting of a mission/vision, 
strategy, and the organization’s core components. The strategic policy plan also includes 
the success indicators and the critical factors for the following areas: legislation, external 


functioning, audit and report, personnel, and organization. 


Figure 6: SAI’s strategic triangle 








Mission 
Primary Function 
Reason for being 






Vision and Core Values 
Policy, ambitions for the future 
Values and norms of the organization 


Strategy 
How to achieve this, approach, 
Objectives, steering, KPI's 
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The strategic policy plan was complemented with an Annual plan for the year 2019, which 
includes the activities that need to be undertaken to achieve the goals and objectives. The 


SAI did not develop an annual plan for the year 2020. 


The SAI’s strategic policy plan reflects on most of the expectations for a proper strategic 
plan according to the SAI PMF criteria. However, a few weaknesses were identified. First, 
the Strategic Policy plan 2019-2022 was not based on an assessment of the institutional 
framework?!, in which the SAI operates. Also, the SAI has many stakeholders but only the 
Parliament, as a key stakeholder, was selected to conduct a SWOT-dialogue*? on the SAI, 
when preparing the strategic policy plan. The expectations and emerging risk from 
Parliament were also not clearly factored into the strategic policy plan. 


The SAI’s strategic policy plan states that one of the SAI’s objectives is to fulfill its legal 
mandate independently and impartially. To achieve this the SAI is currently reviewing and 
updating its legal framework and also working towards meeting the standards set by the 
International Organization Supreme Audit Institutions (INTOSAT). 


Dimension (ii): Content of Annual/Operational Plan 


For the year 2020 the SAI did not develop an annual/operational plan. If we assess the 
Annual plan of 2019, it indicates that the vision described in the Strategic Policy plan 
2019-2022 was concretized in the Annual plan 2019, which specifies the objectives, 
actions, timetable, and those responsible for realizing the relevant objectives. The Annual 
plan 2019 covered only the SAI’s support services aligned with the Strategic Policy plan’s 
2019-2022 objectives. These are amongst other HR and training, IT, legislation, and 
stakeholder communication. 

As previous mentioned, for the year 2020, there was no annual/operational plan. The Head 
of the SAI is in the last phase of finalizing an operational plan for the year 2021. 


The shortfalls of the Annual/Operational plan 2019 are the exclusion of any performance 
indicators. Also, not all of the main support services are included in the annual plan; these 
are financial management and infrastructure. The annual plan does not contain or is not 
linked to a budget assigned to meet the activities. The plan also does not include risk 
analysis, indicators, and a baseline of the current performance. The annual plan does have 
critical success factors, but these are not clearly specified in such a matter that it can be 
measured. Lastly, the major indicators’ milestones were somewhat vague described to 


achieve the internal and external strategic activities. 


Dimension (iii): Organizational Planning Process (Development of Strategic Plan 
and Annual/ Operational Plan) 


In 2017 the Head of SAI came with an initiative to let an external consultancy agency 


assist with the organizational matters in the organization. The whole staff was involved in 


31 For instance, the formal and informal practices that govern the SAI’s operations, as well as country governance, 
political economy and public financial management systems. 

32 In year 2018 the Head of SAI conducted a SWOT-dialogue with Parliament to identify the SAI’s Strengths, Weakness, 
Opportunities and Threats. 
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the discussions on the matters that affected the SAI and everyone could provide their 
input. Everyone within the organization had the opportunity to give their input and 
comment on both the organizational matters and the strategic policy plan. The acting 
chairman, the acting Secretary-General, and the project leader were involved in the 


organizational planning process. 


One of the SAI PMF criteria indicates that a variety of stakeholders should be consulted 
when developing the strategic policy plan. There is no evidence that a variety of 
appropriate external stakeholders were consulted as part of the strategic policy plan 
process for SAI Aruba. Only Parliament as the main key stakeholder was consulted during 
the process. 

There was also no formal document process for monitoring the SAI’s progress against its 
strategic policy plan and annual plan. However, many management decisions that were 
made during the year of 2019 and 2020, were to some extent aligned with the vision and 


activities of the annual plan. 


Dimension (iv): Monitoring and Performance Reporting 

The SAI does not prepare an annual performance report. Instead the SAI publishes every 
year an annual report which includes their operations and performance throughout the 
previous year. However, the annual report did not include the SAI’s performance against 
its planned activities and is not fully aligned with the strategic policy plan, which is a 
criteria addressed by the SAI PMF. 


The SAI did not engage any public on their feedback to follow up on their visibility, 
outcomes, and impact. There is also no evidence that the SAI measures nor publishes any 
statistics on the impact of the SAI, and no reports have been published on peer review or 
independent external assessment. One of the criteria of this dimension states that the SAI 
should publish the audit standards and methodologies they apply. Since the SAI has not 


yet adopted standards for their audits, these have not been published. 


Assessment Findings and Observations 


Dimension Findings 






















Criteria a, b, , and g have been met. 





(i) Content of the Criteria c, d, e, and f have not been met. 

Strategic Plan 

The current Strategic Policy plan 2019-2022 is based on a needs assessment 
covering all main aspects of the organization. The strategic policy plan was 
made public in July 2019. The strategic policy plan incorporates a results 
framework with a long-term vision, a mission that states the purpose of the 
SAI and goals and objectives are identified to implement the strategy. 
Included also are success indicators and critical factors in the following areas: 
legislation, external functioning, audit and report, personnel and organization. 
However, the expectations and emerging risks from all key stakeholders were 


not clearly factored into the strategic policy plan. 






All criteria were not met. 
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Dimension 


(ii) Content of the 
Annual/ Operational 


Plan 


(iii) Organizational 
Planning Process 


(Development of 


Strategic Plan and 


Annual/ Operational 


Plan. 


(iv) Monitoring and 
Performance 


Reporting 





Findings 

For the year 2020 there was no annual plan. However, for the year 2019, the 
annual plan covered only the SAI’s support services that where aligned with 
the objectives described in the Strategic Policy plan 2019-2022. 

The shortfalls of the Annual/Operational plan of the year 2019 are the 
exclusion of performance indicators. The Annual plan 2019 does not contain 
or is not linked to a budget assigned to meet the activities. Also, the plan does 
not include a risk analysis, indicators and a baseline of the current 
performance. The annual plan does have critical success factors, but these are 
not clearly specified in such a matter that they can be measured. 





Criteria a, b, d, and e have been met. 


Criteria c, f, g, h, and i have not been met. 


All staff members were involved in the development of the Strategic Policy 
plan 2019-2022. 

There was effective communication during the organizational planning 
process. 

There was no formal document process for monitoring the SAI’s progress 
against its strategic policy plan and annual plan. Many management decisions 
made during the year were to some extent aligned with the vision and 
activities of the annual plan. 





All criteria have not been met. 


The SAI does not have any documentation regarding monitoring and 
performance reporting, since this does not take place. The SAI does not 
report on the performance and progress of the strategic policy plan as it 
should. The SAI publishes an annual report every year which includes its 
operations and performance from the previous year. 





4.2.2 SAI-4: Organizational Control Environment - Score 0 


SAI-4 provides the principles and expectations for a SAI in terms of: 


e ethical behavior and standards; 

e internal control within the SAI; 

e quality control throughout the audit cycle; and 

e quality assurance on selected completed audits to assess compliance with the auditing 


standards and audit manuals. 


Well-developed arrangements for establishing, 


maintaining, and developing these 


competencies are essential for a SAI to operate within an environment that results in audit 


outputs that end-users can rely upon. 


This indicator has four dimensions: 


(i) Internal Control Environment —- Ethics, Integrity and Organizational Structure. 


(ii) System of Internal Control. 


(iii) Quality Control System. 


(iv) Quality Assurance System. 
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The assessment of SAI-4 is mainly based on the Code of Ethics (2020), the Integrity Policy 
plan (2020), the Organizational Handbook (2012) and the internal Handbook for the 
Financial Administration (2013). 


Dimension (i): Internal Control Environment -_ Ethics, Integrity and 
Organizational Structure 


Recently, in 2020, the Head of SAI formally established and approved a new code of ethics, 
that is in line with the ISSAI 30. The code of ethics was presented to all personnel and 
was made publicly available on the SAI's website. The staff is required to always engage 
in conduct consistent with the values and principles. This conduct is mainly derived from 
the SAI's strategic policy plan and the existing culture that lives within the SAI. Since the 
code of ethics was recently introduced, it cannot be used as the main source from where 


the staff's conduct is derived. 


In the past, the SAI did not formally require any third-party to commit to the SAI's ethical 
requirements. Some parties did sign a confidentiality agreement in the past, whereas other 
parties did not. No policy enforced this requirement until recently when the Integrity Policy 
plan 2020 was introduced. Since then, any party that is contracted by the SAI to carry out 
any work on behalf of the SAI, will be asked to sign an integrity declaration form. 

The recently established integrity policy plan also has a procedure in place on how to 
report any wrongdoing. Still, it does not have a system in place for protecting those who 
report the wrongdoings. 

Since the Integrity Policy plan 2020 was recently approved, the ethics control system is 
not yet fully in place. The team could therefore not assess the functioning of the ethics 
control system such as the response to breaches in ethical values. In the past five years, 
the SAI has not assessed its vulnerability and resilience to integrity violations. The last 
assessment that took place, using the IntoSAINT tools, was held in 2012. The SAI planned 
to carry out an assessment in 2020, but due to the Covid-pandemic, this assessment had 
to be postponed. The results and recommendations of the assessment held in 2012 were 
incorporated into the Integrity Policy plan of the year 2020. 

To guide the official reporting relationships that govern the SAI’s workflow, an 
organizational handbook was established. The Organizational Handbook 2012 includes an 
Organogram and the responsibilities for all work carried by the SAI. The handbook 
describes all activities, responsibilities, and job descriptions for each SAI function and 


includes clear reporting lines. 


Dimension (ii): System of Internal Control 


A central element for managing and controlling risk is to have a system that can identify, 
mitigate and monitor major operational risks. SAI Aruba has not yet developed a system 
that includes these elements. The SAI uses laws, regulations, and guidelines applicable to 
the whole government as a tool for the mitigation of compliance risks that the SAI can 
encounter in their operations. 

For some internal control activities, the SAI applies internal policies and procedures, such 
as: 


1. Authorization and approval procedures on expenditures. 
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2. Segregation of duties in the purchasing process. 

3. Control over access to digital audit folders. 

4. Verifications on purchased goods. 

The Secretary-General is mainly responsible for carrying out the risk management 
responsibilities. The SAI, however, does not have a process or system in place for 


identifying and monitoring major operational risks. 


Internal control over financial reporting 

The SAI's annual report does not include a statement of internal control, that is signed by 
the Head of SAI. The SAI has also not assigned staff with the responsibility to conduct 
internal auditing. The annual report of the SAI does include a review report of an 
independent accountant. However, the independent accountant only assesses the SAI's 
financial administration and the internal control measures embedded therein, to the extent 
that is relevant in assessing the financial accountability. 

Apart from the external accountant's review, the SAI has not undertaken an internal 
control in the past five years that covers all the elements of internal control according to 
the INTOSAI GOV 9100. 

The SAI also does not have a system in place to monitor the implementation of 
recommendations from the independent accountant. The review results from the 
independent accountant are shared with the Head of SAI and the Secretary-General. They 
decide, whereas any implementation will take place, based on the recommendations. 
However, the Head of SAI did discuss with the Secretary-General on correcting the findings 
of the independent accountant and to pass on these corrections to the independent 


accountant in the following review for evaluation. 


According to this dimension, the SAI should also have a procedure in place for employees 
to report suspected violations and a policy to manage conflict of interest. The Integrity 
Policy plan 2020 addresses how employees should report suspected violations. The SAI 
does not have a job rotation policy to manage conflict of interest. However, internally the 
staff discuss how to handle possible conflicts of interest. For example, employees who 
have a relative at the auditee, are not allowed to participate in the audit team to avoid 


conflict of interest. 


Dimension (iii): Quality Control System 

The SAI has not established policies and procedures that promote and guarantee the 
quality of the audit work. Nonetheless, the SAI staff follows non-documented procedures 
to guarantee a certain level of quality for the investigations and non-audit activities. 

The project leader?? is responsible for the quality of work delivered by the audit team. 
Since a project leader's position has been vacant for many years, the Secretary -General 
and the personnel in charge of the audit conduct quality control on the audit work. 

For the financial and operational activities, there are procedures in place for quality 


control. Still, the function responsible for guaranteeing the quality has also been vacant 





33 The job description of the project leaders clearly states that he/she is accountable to the Secretary -General for the 
quality of the audit work. 
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over the past five years. Hence, the Secretary-General is responsible for the quality of all 
the non-audit activities. 

Although the audit team follows certain procedures for quality control in practice, these 
are not documented or have not been formally established by the Head of SAI. With the 
years and experience, the SAI’s audit staff has gained the knowledge on how to ensure 


that all reports published by the SAI are properly revised to ensure proper quality. 


The Secretary-General has the responsibility** for guaranteeing the quality, efficiency, and 
effectiveness of the work conducted by the SAI staff. The Secretary-General advises the 
Head of SAI on the approach and quality of the audits. However, the Secretary-General 
does not have the final responsibility regarding the content of the investigation results, 
nor on the content of the message that the Head of SAI wants to communicate. 

The SAI has not yet established a system that considers the risk to the quality of the audit 
that the SAI can encounter when carrying out an audit. However, the audit staff considers 
the complexity of the audit topics, which is a quality-risk element, during the selection for 
the annual plan. 


The SAI also does not have a system in place that considers the work program and the 
limited resources available within the SAI to maintain the quality of the work performed. 
For years, the SAI has faced a shortage of personnel, which affects the quality and the 
scope of work by the SAI. 


Dimension (iv): Quality Assurance System 


SAI Aruba does not have a formal monitoring process that includes concrete procedures 
to provide quality assurance on the completed audit work. 

As was mentioned in dimension (iii), the Secretary-General assumes the final 
responsibility for the quality of the audit and non-audit activities. The monitoring process 
that the Secretary-General should take to ensure the quality of the audit and non-audit 
activities is not documented, which should include concrete steps and frequency for the 
quality review. 

The Secretary-General advises the Head of SAI after he/she has reviewed the work and 
provided the necessary feedback and quality control. However, since no quality assurance 
takes place, the Head of SAI cannot examine the recommendations from the quality 
assurance reviews. 

The SAI also does not have a formal monitoring system for quality control of their 
operational activities. The Secretary-General uses a self-made to-do list to ensure that all 
of her main tasks are carried out, but does not systematically addresses the quality of the 
work. 

SAI Aruba has never appointed another SAI or other body to conduct an independent 


review of the overall quality control system. 





34 This responsibility is clearly defined in the job description that is included in the organizational handbook. 
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Assessment Findings and Observations 

Dimension Findings 
Criteria a, b, d, f, h, i, j, and | have been met. 
(i) Internal Control Criteria e, g, and k have not been met. 
Environment - Criteria c is not applicable. 
Ethics, Integrity 
and Organizational SAI Aruba recently established and formally approved a code of ethics that is in 
Structure line with the ISSAI 30. Since the code of ethics is new, it has not yet been fully 
put in to practice. The SAI has also not yet implemented an ethics control system 
to identify and analyze all ethical risks. 





Criteria i is met. 

(ii) System of Criteria a, b, c, d, e , f, g, h, and j have not been met. 

Internal Control 

The SAI does not have a system in place that can identify and monitor all 
operational risk. Instead the SAI uses laws, regulations and guidelines that are 
applicable for the whole government and for some internal (operational) 
activities the SAI has developed manuals that may cover some aspects of 
internal control, but is not supported by a complete control system as ISSAI 
9100 describes. 





Criteria c is met. 

(iii) Quality Control Criteria a, b, c, d, and e have not been met. 

System 

There are no established policies and procedures that promote and guarantee 
the quality on the audit work. The project leader and the Secretary-General are 
accountable and subsequently responsible for the quality of the audit work. The 
SAI has also not established a system that takes into account the risk that arise 


when conducting an audit. 





All of the criteria were not met. 


(iv) Quality 
Assurance System The SAI does not have a quality assurance system in place and does not conduct 


quality assurance. The Secretary-General is responsible for the quality control, 
but since there is no system for quality control she/he cannot review the quality 
audit process for assurance. 














4.2.4 SAI-6: Leadership and Internal Communication - Score 2 


SAI-6 seeks information on the leadership style of the SAI and how it communicates its 
decisions and requirements internally. Leadership style is important in all organizations to 
ensure that senior management establishes the ‘tone at the top’ through setting personal 
standards of behavior in, for example, ethical, personal, integrity, and objectivity 
attributes. 

All SAI personnel must be kept up to date on all developments affecting the SAI, and these 
can be technical and non-technical information and guidance. In the absence of an 
effective communication strategy, the SAI will run the risk of important messages being 
missed by intended receivers with the result that expected actions or decisions are not 
delivered. 
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This indicator has two dimensions: 
(i) Leadership. 


(ii) Internal Communications. 


The assessment of SAI-6 is mainly based on the rules of procedure of SAI Aruba, Annual 


report 2019, and invitation presentations or invitation meetings. 


Dimension (i): Leadership 


The SAI leadership, which is formed by the Head of SAI, and the Secretary-General, has 
board meetings every other week. These board meetings take place according to the rules 
of procedure, which state that the Head of SAI should meet minimum two times per month 
in the presence of the chairman, members, and Secretary-General. During every board 
meetings, the Secretary-General documents all key decisions and topics that are 
discussed. In addition, the Secretary-General also calls on staff meetings to provide 
feedback on the board meetings. 

The SAI identified its key values such as, integrity, objectivity, transparency, openness, 
and professional, in the Strategic Policy plan 2019-2022 and in the Annual report 2019. 
However, the SAI did not promote its value in public activities or regular communications 


during the year, which is a feature of effective leadership according to the SAI PMF manual. 


ISSAI 20 indicates that the SAI should have a system in place where managers (Secretary- 
General, project leaders, and audit leaders) can be held accountable for their actions. By 
system, we mean KPI, policies, or procedures for internal control and quality control of 
audits. SAI Aruba does not have a system in place but in such case may call on the general 
legislations established for the civil servants. 

The SAI has internal rules of procedure that state that the Secretary-General is authorized 
by the Head of SAI for the organization's management. The project leader's function profile 
also states that the project leader is accountable to the Secretary-General for the audit 
work quality. 

In practice, before getting a promotion, performance appraisals have to take place. The 
personnel of the SAI may also be held accountable for their actions when requesting a 
promotion. Performance appraisal should take place yearly, which is not the case at the 


current moment. 


The SAI leadership has considered strategies to stimulate better performance, for instance 
by taking an initiative to develop a Personal Development plan for all staff. Also, the SAI 
is bound by the procedures and possibilities laid down in the civil servants’ legislation. The 
legislation states that the employees can receive gratification in the form of performance 
reward, but this is only possible in exceptional cases, namely where there is an exceptional 


performance by the public servant. 


The SAI leadership has set a tone in the past to enable accountability and strengthening 
the culture of internal control. The initiatives taken, were in the form of establishing a 
strategic policy plan, an annual plan, an integrity policy plan, and a code of ethics. These 


initiatives however, did not cover all elements of internal control. For instance, no concrete 
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initiatives have been taken to address audit risk or to conduct audits more efficiently and 
effectively. 


The SAI leadership has also demonstrated initiatives for building an organization's ethical 
culture by developing a code of ethics that covers all the values such as maintaining high 
standards of professionalism, accountability and transparency in decision making; 
encouraging an open and mutual learning environment where difficult and sensitive 
questions can be raised and discussed, just to mention a few. The initiative derived from 
an IntoSAINT report was sent to the Head of SAI in 2012, describing the need for an 
integrity policy plan. Many actions were taken in the area of training and development of 
the facilitator. However, it was until 2018, that the Head of SAI set it as a priority for 


developing an integrity policy plan and a code of ethics. 


The SAI leadership has also demonstrated some initiatives about the activities related to 
the quality of the audit work. With the Strategic Policy plan 2019-2022, the SAI wants to 
achieve a high quality of audit work by adopting the ISSAI standards. To achieve these 
objectives, the audit should meet high-quality standards. The SAI leadership however, has 
not established any policies or procedures to meet these high quality standards. 


Dimension (ii): Internal Communications 


The SAI has not established an internal communication plan. Since SAI Aruba is a very 
small organization, there is open and informal communication between the staff and the 
Head of SAI. The SAI uses some appropriate tools to promote effective internal 
communications, such as emails, and regular meetings. Also the SAI promotes informal 
internal communication throughout the use of a WhatsApp group. Since 2019 the 
Secretary-General informs and regularly consults with the staff on key issues regarding 
the organization. The SAI management and staff communicates regularly through formal 
and informal meetings. There are plenary sections, feedback meetings, team meetings, 
and informal meetings. The SAI does not have an intranet, but it does have an ERP-system 
where employees can request vacation days, view the staff availability and account for 


the hours spend during audit and non-audit activities. 


Assessment Findings and Observations 


Dimension Findings 












Criteria a, b, e, f, and g have been met. 


(i) Leadership Criteria c, d, and h have not been met. 


The SAI leadership, consisting of the Head of SAI, meets every other week in 
the presence of the Secretary-General. 

The SAI does not have a system yet in place where managers can be held 
accountable for their actions. 

The SAI leadership has demonstrated initiatives for building an ethical culture 
in the organization by developing a code of ethics that cover all the values 


mentioned in this criteria. 





Criteria b, c, d, e, and f have been met. 3 


Criteria a has not been met. 
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Dimension Findings 


(ii) Internal The SAI uses appropriate tools to promote effective internal communication. 


Communication Since the SAI is a very small organization the interactions between the staff and 


management is an open informal communication. 








4.2.5 SAI-7: Overall Audit Planning. Score: 1 


SAI-7 seeks information on the processes leading to the production of an overall audit 
plan/control program and its content. 


This indicator has two dimensions: 
(i) Overall Audit/Control Planning Process. 
(ii) Overall Audit/Control Plan Content. 


The assessment of SAI-7 was mainly based on the Annual Audit plan 2020, instruction 
manual for monitoring, minutes from management meetings and internal notes regarding 
the planning for the audit topics 2020-2021. 


Dimension (i): Overall Audit/Control Planning Process 


All of the audits that SAI Aruba carries out during the year are derived from an audit 
annual plan based on a monitoring process that should take place every year. 

Each auditor monitors a ministry during the year and writes an internal note that includes 
three high-risk topics, which are then discussed in a group session. These topics should 
be substantiated with sufficient evidence. A risk analysis is made from the topics from 
each auditor. Afterwards a selection of 10 audit topics is made and presented in an annual 
audit plan to the Head of the SAI. The annual audit plan's approval takes place during a 
board meeting and is documented in the meeting minutes. 

Each year a staff member of the audit department is assigned as project leader for the 
monitoring activities. This person is also responsible for preparing and planning the annual 
audit plan. Monitoring of the audit plan takes place by the audit staff, together with the 
Secretary-General and the Head of SAI. The roles and responsibilities have however, not 
been clearly defined and documented throughout the organization, as the SAI PMF manual 


indicates. 


The audit topics presented to the Head of SAI are derived by means of a risk analysis. 
When conducting the risk analysis, the following areas are covered: financial interest, 
social relevance, complexity, and the unique authority of the SAI. The risks are based on 
the financial aspect, risks regarding the legality, efficiency, and effectiveness. Also, 
inherent risks are considered. The SAI ensures that stakeholders' expectations and 
emerging risks are also included in the audit plan by assessing the public's social relevance 
and how the Parliament can use the audit results. 


When preparing the annual audit plan, the SAI considers which sort of audits they can do, 
according to their mandate. The SAI has the mandate to investigate Aruba's national 
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financial statement, and therefore this investigation is included automatically in all audit 


plans. 


Dimension (ii): Overall Audit/Control Plan Content 


The process from monitoring to the selection of topics, does not take place consistently 
every year as it should, with proper documentation and monitoring activities. There is also 
no evidence that for the years*° under review, the process followed for developing the 
annual audit plan was properly documented. There is also not much evidence that the SAI 
monitored the implementation of the annual audit plan for all the years under review. 

In practice, if there is any change in the audit plan, the Secretary-General and the project 
leader of the monitoring activities adapt the audit plan and inform the Head of SAI. From 
2017 through 2019, there were not many changes or time shifts on the audit plan even 
though the audits were not completed on schedule according to the audit plan. 

When preparing the annual audit plan, the SAI considers that the SAI has limited staff 
resources, and hence cannot conduct many audits. In the past, the SAI had opted to 
increase the number of audits during the year by having the auditors conduct two audits 
parallel. In practice, it was not feasible to conduct two audits parallel without affecting 
the audit quality. 


The SAI's annual audit plan does not include a monetary budget, as indicated by the SAI 
PMF manual. The budget for an annual audit plan instead refers to the amount of time 
needed to complete a certain audit. This is taken into account during the audit planning 
process and may be aligned with a certain preferences from the Head of SAI. In some 
cases, the Head of SAI may request to conduct a quickscan audit with a time frame of a 


maximum of 6 months. 


In case there is limited staff or if the staff does not have the necessary experience or 
knowledge on a certain audit topic, the SAI may opt for a collaboration with an external 


party. 


Assessment Findings and Observations 


Dimension Findings aa 


Criteria b, c, and g have been met. 1 
(Cp me 11 Criteria a, d, e, and f have not been met. 
Audit/Control 
Planning Process Even though the SAI has a process in developing and approving the annual audit 


plan, it has not been followed and documented consistently during the years. 

Prior to the annual plan, a risk analysis is conducted, that covers the following 
areas: financial interest, social relevance, complexity and the unique authority 
of the SAI. The risks are based on the financial aspect, risks regarding the 
legality, efficiency and effectiveness. Also, the inherent risks based are 


considered. 





Criteria a, b, and c have been met. 2 


Criteria d and e have not been met. 














35 The annual audit plans for the years of 2017 and 2018 were not formally approved. 
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Dimension 


(ii) Overall 


Audit/Control Plan 


Content 


4.3 Domain C: Audit Quality and Reporting 


Findings 


The annual plan of SAI Aruba includes amongst other the objectives, time 


schedule and resources for each audit. The annual plan does not include the 


financial resources necessary and an assessment of the risks and constraints. 








Domain C aims to assess the quality as well as the outputs of the audit/control work that 


represents the core function of any SAI. Domain C comprises 13 indicators. 


Domain C: Audit Quality and Reporting 


Dimensions 





Overall 


score 


1 








Oo 



































Indicator Name iT iii iv | 
Audit Coverage 
Financial Audit Standards and Quality 
Management 
SAI-10 Financial Audit Process 0 0 0 
SAI-11 Financial Audit Results 0 0 0 
SAI-12 Performance Audit Standards and Quality 0 0 i 
Management 
SAI-13 Performance Audit Process 2 3 3 
SAI-14 Performance Audit Results 4 4 3 
SAI-15 Compliance Audit Standards and Quality 0 0 2 
Management 
SAI-16 Compliance Audit Process 1 0 1 
SAI-17 Compliance Audit Results 2 4 0 
SAI-18 Jurisdictional Control Audit Standards and N/A | N/A | N/A 
Quality Management 
SAI-19 Jurisdictional Control Audit Process N/A | N/A | N/A 
SAI-20 Results of Jurisdictional Controls N/A | N/A | N/A 


























4.3.1 SAI-8: Audit coverage - Score 1 


This indicator measures the audit coverage achieved by the SAI 


audit disciplines — financial, performance and compliance. 


This indicator has four dimensions: 


(i) Financial Audit Coverage. 


(ii) Coverage, Selection and Objective of Performance Audit. 


(iii) Coverage, Selection and Objective of Compliance Audit. 


(iv) Coverage of Jurisdictional Control. 


across the three main 


The assessment of SAI-8 covers the scope, selection and objective of the financial, 


performance, and compliance audit. The evidence used is mainly based on the National 


Ordinance Court of Audit Aruba, version 1998, the Compliance Regulation 1989, risk 


SAI Performance report of SAI Aruba 


analysis of the audit plan 2020, and the current instruction manual for conducting 


monitoring. 


Dimension (i) Financial Audit Coverage 


According to the SAI’s mandate, the SAI should submit a report on the review of the 
national financial statement, the financial statement of the public entities (1), the financial 
statement of the established companies and legal entities by National Ordinance (9), and 
of the budgetary funds (13). The SAI’s mandate, however, does not address specifically 
that the SAI should conduct financial audit on these entities. The mandate refers to the 
Compliance Regulation 1989, for further elaboration on the criteria that needs to be 
examined. The Compliance Regulation 1989 does not includes an acceptable financial 
framework that the SAI can use to conduct a financial audit. 

In the past the SAI has reported that the financial framework is not acceptable, which is 
why it was decided that as long as there are no acceptable financial frameworks used by 
the government, the SAI cannot perform a financial audit on the national financial 
statement. The national financial statement also has many deficiencies in the areas of 
internal control and financial management, for the SAI to conduct an efficient audit. The 
SAI only investigates whereas the national financial statement complies with the 
requirement stated in the Compliance Regulation 1989. 

A commission was installed that had as objective to tackle the different shortfalls on the 
national financial statement, including the reporting framework. SAI Aruba participated in 


this commission, as observer, but unfortunately little progress was made. 


Dimension (ii) Coverage, Selection and Objective of Performance Audit 


Audit coverage 

The SAI has the mandate to conduct performance audits. The principles and coverage for 
this type of audit have not been set clearly and documented as described by ISSAI 1:4. 
For the file under review, the principle of effectiveness was partially taken into account, 
and recommendations for improvement were given. 

The SAI has not set priorities for performance auditing based on the notion that economy, 
efficiency and effectiveness are audit objectives of equal importance to the legality and 
regularity of financial management and accounting. As the current monitoring process 
does not consider these principles of equal importance, it has an impact on the audit 
coverage. The SAI also has limited staff to conduct performance audit investigation in 


many sectors and different topics. 


Topic selection and objective 

The SAI PMF criteria indicates that the SAI should issue reports that cover sector/topics 
such as defense, education, environment, health, infrastructure, revenue collection and 
national economic development. Due the SAI’s size it is not feasible to cover many 
sectors/topics within a time period as described by the SAI PMF criteria. For the years 
under review, the SAI only issued reports that covered the infrastructure sector. 
Performance audit topics are selected through a monitoring process that takes place during 


the year. The most relevant topics from the monitoring are analyzed and the risks are 
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assessed. The risk assessment is conducted as a group to avoid one-sided assessment. All 
topics derived from the monitoring activities are analyzed, to ensure that the selected 
potential topics are of value and can be carried out by the SAI. One of the criteria when 
conducting the risk analysis is to assess whereas the topics are likely to have an impact 
and whereas the SAI has the sole power to conduct such audit. In the risk analysis, the 
SAI also takes into consideration the social relevance of the audit and the information 
value for the Parliament, which may cover to some extent the stakeholders expectations 
and emerging risks. The stakeholder’s expectations and emerging risks are however, not 
clearly defined as it should be, so it could be factored in the audit plan. The SAI also does 


not have a monitoring system fully in place to guarantee sufficient audit coverage. 


Dimension (iii) Compliance Audit Coverage 
Audit coverage 


According to the SAI’s mandate, the SAI should submit a report on the review of the 
national financial statement each year. In practice this review is more in the form of a 
compliance audit. The SAI has the mandate to conduct compliance audit in all public 
entities and budgetary funds. Not all the entities in the SAI’s mandate are audited during 
a reasonable period, as it should according to the SAI PMF criteria, due to a lack of staff 
capacity. The SAI does cover processes and themes that should be audited on compliance, 


but does not cover all the entities within its mandate. 


Topic selection 

The annual audit plan does not mention the entities that are subject to compliance audit. 
Instead of mentioning the entities, the annual audit plan covers the themes that are 
subject to compliance audit when conducting the investigation to the national financial 
statement, which takes place every year. 

During the past three years, the SAI’s annual audit plan included topics that in some form 
were related to payroll. Other topics such as overspending and sustainability of the 
government finance were addressed as part of the investigation on the national financial 
statement. 

The annual audit plan includes topics that are subject to a compliance audit and are 
included in the investigation on the national financial statement, for so far they are related 
to the financial statement. 

The SAI’s annual audit plan is based on a risk analysis, which also assesses the materiality 


of the selected topics. 


Assessment Findings and Observations 


Dimension Findings 





The score is 0 because SAI Aruba does not conduct a financial audit on the 
(i) Financial Audit national financial statement nor the financial statement of the other entities. The 
Coverage SAI does not conduct financial audit on the received national financial statement 
due to the absence of an acceptable financial framework and deficiencies in the 


financial management. 













Criteria c, e, f, g, and h have been met. 





Criteria a, b, and d have not been met. 
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Dimension Findings Score 
(ii) Coverage, The SAI has a mandate to conduct performance audit. For the file under review, 
Selection and the principle of effectiveness were partially taken into account, and 
Objective of recommendations for improvement were given. The SAI does not have a 
Performance Audit monitoring system fully in place and the necessary audit staff to guarantee 
sufficient audit coverage. 
Criteria d is met. (6) 


(iii) Coverage, Criteria a, b, and c have not been met. 


Selection and 


Objective of The SAI has mandate to conduct compliance audit. For the period under review, 
Compliance Audit audit on compliance was part of the investigation on the national financial 
statement. Not all the entities in the SAI’s mandate are audited during a 
reasonable period, as it should according to the ISSAIs, due to a lack of staff 
capacity. 











4.3.2 SAI-9: Financial Audit Standards and Quality Management - Score 0 


This indicator assesses the SAI’s financial auditing approach in terms of its overall 
standards and guidance, team management and skills, and quality control. 


The indicator has three dimensions: 

(i) Financial Audit Standards and Policies. 

(ii) Financial Audit Team Management and Skills. 
(iii) Quality Control in Financial Audit. 


The assessment of SAI-9 was mainly based on ISSAI 1000-1800 for the financial audit 
guidelines and ISSAI 200 as standards for conducting a financial audit. The reports on 
investigation of the national financial statement and related documents were also used as 


sources to assess these dimensions. 


Dimension (i): Financial Audit Standards and Policies 


For this dimension, all the criteria were assessed as not met. SAI Aruba has the mandate 

to submit a report on the review of the national financial statement. 

The SAI however does not conduct a financial audit as it should for a few reasons, which 

are: 

1. There is a lack of a formal and acceptable financial reporting framework and therefore the 
SAI cannot assess whether the preconditions have been met. 

2. The national financial statement has many deficiencies in the areas of internal control, 
financial information which prevents an efficient audit, and lack of adequate laws and 
regulations. The SAI does not have a suitable criteria to properly audit the national financial 
statement. 

3. The SAI has not yet adopted the Financial Audit Guidelines ISSAI 1000-1810 or the ISSAI 
200 as their standards for conducting financial audits. 
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As the national financial statement has many deficiencies, the SAI reduces their audit risk 
by limiting their activities to only investigating the internal consistency and the external 


coordination. 


Since the SAI does not conduct a financial audit based on international standards, it does 
not have a procedure to reduce its (materiality) risk to an appropriate level. The concept 
of materiality is not considered, to the extent of the ISSAIs when planning and performing 
financial audits. In practice, materiality is being applied at a higher level of abstraction by 
conducting a pre-assessment on the financial statement figures. The concept of materiality 


is not laid down in any policies and procedures. 


Audit evidence and documentation 

The reports on the national financial statement are based on the note on findings*® 
prepared by the audit team and based on evidence collected during the audit process. The 
note on findings is supported by a dossier (audit documentation) that includes all evidence, 
documents, legal framework, and interviews with their corresponding commentaries. 
Information about the nature and timing of the audit is included in the audit?” proposal. 
The audit documentation is not always reviewed by other auditors within the SAI, that 
were not part of the team. There are also no documented policy and procedures on how 
the auditor should prepare audit documentation that is sufficient to enable an experienced 


auditor to understand the nature, timing, and extent of the audit procedures. 


Communication 

There is a standard procedure regarding communication during and prior to the audit, but 
it has not been documented. In practice, before each audit, the corresponding minister is 
informed through a formal letter that an audit will take place on their subordinate entities. 
The minister in turn, may send a letter to their department asking for collaboration during 
the audit. The audit team will then contact each department by mail or phone to set up 
an interview. During the interview, the audit team communicates the scope of the audit. 
The audit findings are sent to the entities, who are allowed to provide commentary on the 


results. 


As the SAI does not conduct a financial audit, procedures for assessing fraud and the risk 


of material misstatement, and other aspects are not in place. 


Dimension (ii): Financial Audit Team Management and Skills 


This dimension examines whether the SAI has established a system for ensuring that the 
audit team members collectively possess the professional competencies and _ skills 
necessary to carry out the audit in question, as required by ISSAI 200. The SAI did not 


meet any of the criteria for this dimension. 


36 The note of findings is the name used by the SAI on the document that includes all audit findings gathered during the 
investigations. 

37 In this report the SAI used the term audit proposal, however, it should be taken into consideration that the SAI does 
not conduct audit according to the relevant (international) standard. 
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SAI Aruba does not have a system in place to ensure that the team members collectively 
gather the appropriate competences and capabilities to conduct financial audit in the 
future. Currently, the SAI tries to have a rotation system to ensure that every auditor 
gains practical experience for conducting the investigation on the national financial 
statement. This system is however, not documented and does not take place continuously. 
There is also no evidence that this rotation system guarantees that the auditor will gain 


the practical experience. 


Since the SAI has not yet adopted the financial audit guidelines and standards, the team 
does not have a complete understanding of these professional standards regarding 
financial audits. However, the SAI understands and applies the legal and regulatory 
requirements applicable to Aruba. 

Every investigation on the national financial statement needs to have a team that consist 
of a project leader, either internal or external, and that has a specialization in the 
accounting or auditing field. When selecting the team members, the SAI ensures to include 
staff with relevant experience or a background education in the accounting field. 

ISSAI 200 states that the SAI should establish a system to ensure that the audit team has 
knowledge of relevant industries in which the audited entities operates. Since the SAI has 
limited number of auditors, the SAI does not have teams that have specialized knowledge 
in all industries and fields. The monitoring process, however, gives the auditors some 
basic knowledge of certain industries, but there is no system in place to guarantee that 


they have the necessary skills in all industries that are eligible for audit. 


The SAI does not have quality control policies and procedures in place. In practice, 
auditors that have more experience, review the team's work before the report is published. 
The Secretary-General is also responsible for guaranteeing the quality of the investigation 
before it is published. 

The SAI's mandate states that all reports are public upon receipt by the Parliament. The 
SAI has no further applicable reporting arrangement by mandate. In practice, the SAI 
follows the practical reporting arrangements used at the SAI Netherlands. The existing 
law leaves the manner of reporting to the SAI. Through experience, common practices are 
passed on within the SAI, but there are no formal reporting arrangements in place. 

The support that the team members receive from the SAI, when investigating the financial 
statement, is not in the form of manuals, but more in the form of ‘access to experts’ 
available by SAI Netherlands and other experts. In 2012, SAI Netherlands provided SAI 
Aruba with handbooks and templates guidance, for instance handbooks on how to develop 
an audit proposal, the writing of reports, and handbooks that describes the steps in the 
research process. The SAI has used these templates since then. However, there is no 
evidence that these templates are according to the ISSAI 200:83 and that they were 
formally adopted. 


Dimension (iii): Quality Control in Financial Audit 
This last dimension is regarding the quality control procedures at the engagement level. 


These procedures should provide reasonable assurance that the audit complies with 
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professional standards, applicable legal and regulatory requirements and that the auditor’s 
report is appropriate in the circumstances. 


The SAI does not have a policy that recognizes the importance of quality control of the 
audit process. There are also no formal procedures in place for authorizing reports to be 
issued. In practice, the Head of SAI and the Secretary-General gives the authorization to 
issue any reports for instance the note on findings and the final draft reports. 

Work review, to guarantee quality of the reports, takes place by different auditors within 
the SAI. The Secretary-General reviews the audit plan. The work of the team and findings 
are reviewed by both the Secretary-General and the research leader. The quality control 
process is not documented and does not meet all quality criteria as required by ISSAI 40 
and ISSAI 200. 


ISSAI 40 also states that SAI’s should ensure to have appropriate resources to use, when 
dealing with difficult or contentious matters. If difficult or contentious matters arise during 
the audit, SAI Aruba first ensures to resolve any matter internally. 

The SAI also discusses and resolves the differences of opinion within the SAI before a 
report is issued. Any differences in opinion within the team are not documented, but 
verbally discussed. There is no formal procedure in place on how to handle with differences 
in opinions, but professionalism is one of the requirements expected from each auditor in 
the SAI. 

For the period under review, the SAI did not encounter a situation where external technical 
expertise was needed for contentious matters, when investigating the national financial 
statement. However, if necessary, before the investigation, the SAI shall ensure to contact 


the appropriate (external) resources. 


Assessment Findings and Observations 


Dimension Findings Score | 


Criteria a, b, c, d, e, g, h, i, j, k, and | have not been met. 0 
(i) Financial Audit Criteria f is not applicable. 
Standards and 
Policies Since the SAI has not yet adopted the Financial Audit Guidelines ISSAI 1000- 


1810 or the ISSAI 200 as their standards for conducting financial audit, this 
dimension was scored as not met. 

SAI Aruba has the mandate to submit a report on the review of the national 
financial statement, but no financial audit is taking place at the moment. The 
lack of a formal financial reporting framework causes that the SAI cannot 
assess whether the preconditions have been met. The national financial 
statement is not subject to a financial audit as it has many deficiencies in the 
areas of internal control, financial information, and lack of adequate laws and 
regulations. SAI Aruba does not have a suitable criteria to properly audit the 


national financial statement. 





All criteria were not met. 0 


(ii) Financial Audit 
Team Management 
and Skills competences and skills for carrying out financial audits. 


There is no system in place to ensure that all team members have the 
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Dimension Findings 






All criteria were not met. 
(iii) Quality Control 

in Financial Audit Since the SAI does not conduct financial audit it does not have a policy that 
recognizes the importance of quality control of the audit process. The SAI also 
does not have any procedures in place regarding quality control for financial 
audit. 











4.3.3 SAI-10: Financial Audit Process - Score 0 


SAI-10 examines how financial audits are carried out in practice. 


It consists of three dimensions: 


(i) Planning Financial audits. 
(ii) Implementing Financial audits. 
(iii) Evaluating Audit Evidence, Concluding and Reporting in Financial Audits. 


The assessment of SAI-10 was mainly based on a review on the investigation of the 
National Financial statement 2018 and 2019. As mentioned earlier, no financial audit is 
being done. What the SAI did in practice, that can be related to this dimension, will be 
described in the following dimensions. 


Dimension (i): Planning Financial Audits 


As SAI Aruba does not conduct financial audits as the ISSAIs indicates, the planning phase 
does not cover many of the required principles of the ISSAIs. 

Even though the SAI does not conduct a financial audit, the SAI does conduct an 
investigation on the national financial statement each year. In the planning phase for this 
investigation many aspects are considered that are to some extent in line with the ISSAIs. 
Aspects such as materiality are considered when selecting the items that are being 
investigated, the depth of the investigation, and the depth of explanation given in the 
report. 

Before starting an audit, the auditor also conducts a preliminary investigation of the audit 
topic and collects some general information on the audited entity. The auditor also 
considers some other aspects, such as the environment and applicable laws and 
regulations. However, the SAI does not have any documentation in place, in the form of 
procedures or guidelines, that includes all the different aspects that an auditor needs to 


consider when conducting the investigation. 


Proper communication is also considered during the planning phase. At the start of the 
investigation on the national financial statement, the Minister of Finance is notified. The 
Minister of Finance informs the audited entities that the SAI will be conducting an 
investigation. The SAI's audit team will then contact the entities, and during the first 
meeting, they are informed of the audit plan. Since the SAI has the legal mandate to audit 


government entities, no formal agreement is required. When investigating the national 
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financial statement, the SAI collects only information that entails the investigation subject 


at the audited entity. 


During the planning phase, the auditors do not develop an overall audit strategy, as 
required by ISSAI 200, but rather develop a work program that includes all the activities 
to be conducted together with the necessary resources. The work program includes many 
aspects of an overall audit strategy, as described by ISSAI 200:80-83, except for the 


audit's nature. 


Other aspects that should be considered during the planning phase according to the ISSAI 
200, such as understanding of the audited entity, internal control environment, and 


material misstatement risk, are not completely in place. 


Dimension (ii): Implementing Financial Audit 

When implementing financial audit, ISSAI 200 provides the standards that the auditors 
should consider for assessing risks and obtaining audit evidence. 

As no financial audit is being done and according to the ISSAIs, the SAI cannot state, 
whereas the evidence obtained during the investigation on the national financial statement 
is sufficient to meet any of the criteria for this dimension. During the investigation of the 
national financial statement the auditors consider the compliance with the laws and 
regulations as guidance for audit evidence. 

One of the SAI PMF criteria for this dimension states that the SAI’s should obtain sufficient 
and appropriate audit evidence during the audit, by relating it to other external sources. 

When examining the national financial statement figures, the SAI uses the entities’ 
financial statements as external confirmation. The SAI also uses the external accountants’ 
financial declarations (where available) when examining the figures, as a source of 
external confirmation. The work of the CAD is also used as external confirmation, for all 
figures related to the public departments. 

The SAI uses limited analytical procedures and audit sampling as audit evidence. For 
instance, for the year 2017, an analytical assessment was made to compare and analyze 
the actual figures on the type of costs and percentage increase to prior years. The SAI 
uses downloaded data from the central administration program and performs analytical 
assessment using the pivot module of excel. 

The CAD audits the government departments. SAI Aruba works closely with the CAD and 
uses their evidence whenever necessary during the investigation of the national financial 


statement. 


According to ISSAI 200, auditors should respond to assessed risk by designing audit 
procedures. Audit procedures can also be performed to obtain sufficient and appropriate 
audit evidence. 

For the type of investigation that the SAI conducts on the national financial statement, 
the audit procedures are included in a work plan. The work plan guides the auditor on 
which steps to take, to obtain the necessary evidence, to be able to draw any conclusions. 


All tasks, audit procedures, conducted by the team are recorded in a document based on 
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the work plan. The team member is responsible for the audit, and reviews the document 


to determine which audit procedure was not conducted and the motive behind it. 


Dimension (iii): Evaluating Audit Evidence, Concluding and Reporting in Financial 
Audits 


ISSAI 200 addresses the standards that auditor should consider when evaluating audit 
evidence to be able to form an objective opinion and recommendation. It also addresses 
all the elements that the audit report should include. 

At SAI Aruba, the note on findings is an essential document that guarantees the quality 
of the audit evidence. The note on findings is supported by a dossier that includes all 
evidence, documents, legal framework, and interviews with their corresponding 
commentaries. The report on the national financial statement is based on the note on 
findings that the audit team prepares based on evidence and findings gathered during the 
audit process. 

As the SAI's investigation are not based on the financial audit standards, the SAI cannot 
assess whether the preconditions of the national financial statement have been met, as 
required by ISSAI 200. 


Evaluation of Audit evidence 

During the quality control, an experienced auditor goes through the evidence, findings, 
and conclusion to ensure that what is documented in the report is well-founded. However, 
the SAI cannot ensure that the audit documentation is sufficient, was completed on time, 
and is well-ordered since no external review of the audit documentation has taken place. 
After collecting all evidence, the auditor prepares a note on findings, which is sent to all 
audited entities so they can have the possibility to provide their feedback. 

If the SAI encounters a misstatement it is evaluated internally and communicated with 
the audited entity in writing through the note on findings. For example, in 2018, there 
was a misstatement in a public entity's figures and was communicated in a letter to the 


entity. 


All recommendations of the national financial statements are based on the report's findings 
and directed to the minister, who is responsible for the department/matter at hand. 

In a recent report (in 2018), SAI Aruba mentioned the shortfalls when investigating the 
national financial statement. The auditor does not include an emphasis of matter 
paragraph in their reports and does not determine the financial reporting framework's 
acceptability. The auditor also does not mention in the report whether the financial 


statement was prepared, following a special-purpose framework. 


Assessment Findings and Observations 
Dimension Findings 


All criteria were not met. 


(OM AEnar:] 


Financial Audits The SAI does not recognize the financial reporting framework that is currently 


used as acceptable to conduct an financial audit, as it is not prescribed by law 


of regulation. 
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Dimension Findings 


Aspects that to some extent are considered by the SAI in the planning phase 
are materiality, proper communication and developing of an overall audit 
strategy being a work program. 

Other aspects that need to be considered during the planning phase such as 
understanding of the audited entity, internal control environment and risk of 
material misstatement, are not completely considered during the planning 
phase. 





All criteria were not met. 

(ii) Implementing 

Financial Audits When auditing the national financial statement, the auditor takes into 
consideration the compliance with the laws and regulations, but since no 
financial audit is being done, the SAI cannot state whereas the evidence 
obtained is sufficient for the determination of material amount and disclosures 
in financial statements. For the type of investigation that the SAI conducts, the 
audit procedures are broken down into a work plan. The work plan guides the 
auditor on which steps to take, to obtain the necessary evidence, to be able to 
draw a conclusion. All audit procedures conducted by the team are recorded in 


a document, which is based on the work plan. 





All criteria were not met. 


(iii) Evaluating 
Audit Evidence, What the SAI does in practice for the national financial statement is not based 


Concluding and on the financial audit standards, because of the lack of a formal financial 
Reporting in reporting framework. After collecting all evidence the SAI prepares a note on 
Financial Audits findings, which is sent to all audited entities so they can have the possibility to 
provide their feedback on any misstatement. The auditor does not include an 
emphasis of matter paragraph in their reports and does not determine the 
acceptability of the financial reporting framework, due to the shortcoming 
already mentioned. The auditor also does not mention (if it is the case) that 
the national financial statement was prepared following a special-purpose 


framework. 














4.3.4 SAI-11: Financial Audit Results - Score 0 


SAI-11 assesses the timely submission and publication of the results of the SAI’s financial 
audit work and how such results are followed up. 


The indicator has three dimensions: 
(i) Timely submission of Financial Audit results. 


(ii) Timely publication of Financial Audit results. 


(iii) Follow-up on the Implementation of Financial Audit Observations and 


Recommendations 


The assessment of SAI-11 is mainly based on the basis of a review of a sample of audit 
files National Financial statement 2018 and 2019. As has already been said in the previous 
SAI, no financial audit is being done. What the SAI did for this dimension will be described 


in the following dimensions. 
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Dimension (i): Timely Submission of Financial Audit Results 


This dimension assesses whether the above outputs are submitted to the audited entity 
on time. The timely submission is calculated as the time between the approval of the SAI 
and the submission to Parliament. From the two reports under review, only one was 
submitted following the legal time frame. Although 50% of our audits on the national 
financial statements are presented on time, it is still being scored a O, since it is not 
considered a financial audit. 


Dimension (ii): Timely Publication of Financial Audit Results 


The previous dimension assessed the submission of the audit results to the audited entity 
and other authorities. Dimension (ii) focus on whether audit reports and/or opinions are 
published as soon as the legislation allows. The publications of both investigations on the 
national financial statement were made public through the appropriate means (website, 
newspaper, and online media) within 60 days, as required by this criteria, after the report 
was handed to Parliament. Since the SAI does not conduct financial audit, it was scored 
as 0. 


Dimension (iii): Follow-up on the Implementation of Financial Audit Observations 


and Recommendations 


The SAI does not have a follow-up system on the observations and recommendations. The 
SAI submits the recommendations to the Minister of Finance and Parliament, but does not 
follow-up on these in the same year. In practice, the commitments presented by the 
minister in his/her response, are being used and addressed in the next year’s audit. The 
SAI does evaluate the materiality of the observations on the investigation of the national 
financial statement, but not to the extent of the financial audit. There is no follow-up 
procedure where the audited entity provides information on corrective measures taken or 


not taken. 


Assessment Findings and Observations 
Only one of the two reports under consideration was submitted in accordance (6) 
with the legal time frame. The score is considered 0, since no financial audit 


is being done. 





The publication of both investigations on the national financial statement were (0) 
made public through the appropriate means (website, newspaper and online 


media) within 60 days after the report was handed to Parliament. 





The SAI does not have a follow-up system of the observation and (0) 
recommendation in place. The SAI submits the recommendations to the 
minister and Parliament, but does not follow-up in the same year. In practice 
0 3 al Aud the commitments presented by the minister in his/her response, are being 


Observatio and used and addressed in the next year audit. 
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4.3.5 SAI-12: Performance Audit Standards and Quality Management - Score 0 


This indicator assessed the SAI’s approach to performance auditing in terms of its overall 
standards and guidance for performance auditing, as well as how matters of audit team 
management and skills and quality control were implemented at the audit engagement 
level. The quality of these functions at the organizational level is assessed elsewhere in 


the framework: quality control in SAI-4; professional development and training in SAI-23. 


For the assessment of SAI-12, three dimensions were considered: 


(i) Performance Audit Standards and Policies. 
(ii) Performance Audit Team Management and Skills. 
(iii) Quality Control in Performance Audit. 


The assessment of SAI-12 was mainly based on the following documents: 
1. Manual research for efficiency and effectiveness (November 2005). 
2. Organizational Handbook - organization description, structure and job description (18 
December 2012). 
Code of Ethics (1 July 2020). 
4. Manuals report (January 2011). 
Guideline on the content for the note on findings and the reports and National Ordinance 
Court of Audit Aruba (AB 1998 no.GT 20). 


Dimension (i): Performance Audit Standards and Policies 

Even though SAI Aruba has a mandate to carry out performance audits, the SAI has not 
yet adopted the Performance Audit Guidelines ISSAI 3000-3999 or the ISSAI 300 as their 
standards for performance audit. When executing performance audits, the SAI uses 
manuals obtained from the SAI Netherlands as a guideline. These manuals are not fully in 
place in the organization, since they have not been formally approved by the Head of SAI. 
The manuals from SAI Netherlands meet the auditing standards of INTOSAI, but do not 
specifically refer to ISSAI 300 or ISSAI 3000. 


Since SAI Aruba carries outs performance audits, but has not yet adopted and 
implemented the ISSAIs, the dimensions of SAI-12 were assessed as conservative as 
possible. The SAI can then have a realistic view of what is in place and the areas that 
needs improvement if the SAI wants to adopt the ISSAI standards for conducting 
performance audits. 


Below we will summarize the findings for this dimension and present them per principle. 


Audit proposal/audit objective (ISSAI 300:25) 

Before starting an audit the auditors are required to submit an audit proposal to the Head 
of SAI for approval. This proposal includes many elements of performance audit according 
to the ISSAIs, such as auditor, responsible party, intended users, subject matter, and 
criteria. However, there is no documentation or policy in place that states that the auditors 
are required to include these elements. These elements are based on the manual and 


guidelines that were provided by SAI Netherlands. 
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The SAI has criteria in place to identify the audit objective and the principles it needs to 
relate to. 

The audit proposal includes some aspects of the audit objective, that are related to the 
principles of economy, efficiency, and effectiveness. However, the audit objective are not 
clearly defined and sustained. This is because most of the SAI's audits are a combination 


of two audits, for example, a combination of compliance and performance audits. 


Audit approach (ISSAI 300:26) 

The project leader/research leader uses the manual from SAI Netherlands as a guideline, 
when choosing the audit approach to facilitate the audit design’s soundness. 

When choosing the audit approach to facilitate the audit design's soundness, some 
auditors mentioned using the manuals from SAI Netherlands as a guideline. The audit 
proposal under review, indicates that two approaches were combined, namely problem- 
and system-oriented approach. The auditors, however, did not specify clearly which 


approach was chosen. 


Criteria (ISSAI 300:27) 

The project leader/research leader use the manual from SAI Netherlands as a guideline, 
when establishing suitable audit criteria. The auditors should establish a suitable criteria 
that corresponds to the questions related to the principles of economy, efficiency, and 
effectiveness. 

In the audit proposal, the auditors applied a suitable criteria that corresponds to the audit 
question and it relates to some extent, to the principles of performance audit. The audit 
proposal, however, does not give sufficient evidence to what extent the principles of 


economy, efficiency and effectiveness were considered. 


Audit risk (ISSAI 300:28) 

The SAI does not have any standards and policies in place to actively manage audit risk, 
which is the risk of obtaining incorrect or incomplete conclusions, providing unbalanced 
information, or failing to add value for users. The manual of SAI Netherlands, that are 
used, do not address how the auditors should manage audit risk. 


Communication (ISSAI 300:29) 

The SAI does not have any standards and policies in place that describes how to maintain 
effective and proper communication with the audited entities and relevant stakeholders 
throughout the audit process and define the content, process, and recipients of 
communication for each audit. However, the SAI applies common undocumented practices, 
such as informing the corresponding minister through a formal letter and informing the 


audited entities appropriately on the content and process of the audit. 


Skills (ISSAI 300: 30) 

An audit team needs to have the necessary professional competence to carry out 
performance audits. The SAI does not have a policy or procedure in place that ensures 
that the team has the necessary professional competence when carrying out a 


performance audit. 
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Professional judgment and skepticism (ISSAI 300:31) 

The SAI has a code of ethics that reminds the auditors to apply professional judgment and 
skepticism. The code of ethics is derived from the INTOSAI code of ethics ISSAI 30. It 
includes the principles that the auditor should apply, which are objectivity, transparency, 


and professionalism. 


Quality control (ISSAI 300:32) 

The SAI does not have specific standards and policies in place that describes the 
procedures to safeguard quality, to ensure that the applicable requirements are met. In 
practice, the project leader is responsible for safeguarding the quality of the report, and 
the Secretary-General has the responsibility to guarantee the quality of all audits. This 


criteria is described in the organizational handbook. 


Materiality (ISSAI 300:33) 
The SAI does not have any standards and policies in place that describe how to consider 
materiality at all stages of the audit process. 


Documentation (ISSAI 300:34) 

There are no standards and policies for documenting the audit, however in practice all 
audits are documented. In our opinion, the information is sufficiently complete and 
detailed to enable an experienced auditor with no previous connection with the audit to 
determine what work was done to arrive at the audit findings, conclusions, and 
recommendations. There is a template document where all the findings of the audit 
questions are recorded. This template contains the findings with their corresponding 
documents of the audit. 

Planning (ISSAI 300:37) 

The SAI has no standard and policies that describe how to plan the audit, to contribute to 
a high-quality audit carried out in an economical, efficient, effective, and timely manner 
and follows the principles of good project management. For all audits, the project leader 
is expected to plan the audit to contribute to a high-quality audit. This is described in the 
organizational handbook. The audit proposal includes information covering some aspects 
of good project management principles, but these principles have not been documented 


and are not consistently followed by all auditors. 


Audit evidence (ISSAI 300:38) 

Auditors need to obtain sufficient appropriate audit evidence to establish findings, reach 
conclusions in response to the audit objectives and questions, and issue recommendations. 
The manual from SAI Netherlands is used as a guideline when reporting, but is not 
specifically intended for a performance audit. The manual guides the auditors on obtaining 
sufficient, appropriate audit and evaluate the evidence when conducting a performance 
audit. In addition to the manual, there is also a note with guidelines content that is used 
for the note on findings and report. This note, that includes a guideline to the content, 
was compiled by one of the auditors and is used as a refreshment guideline. Although the 
auditor strives to obtain sufficient evidence; there are no official guidelines to ensure to 


what extent the collected evidence is sufficient and appropriate for a performance audit. 
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Reporting (ISSAI 300:39) 

The manual the auditors use as a guideline for reporting also guides the auditors on how 
to carry out the audit so the reports are comprehensive, convincing, timely, reader- 
friendly, and balanced. However, this manual is not specifically intended for a performance 
audit. In addition to the manual, there is also a note with guidelines for the note on 
findings and the report. 

The SAI does not have any standards and policies in place that should be considered to 


make the reports widely accessible, in accordance with the SAI’s mandate. 


In its reports the SAI seeks to provide constructive recommendations if relevant and 
allowed by the SAI's mandate. The manual for reporting and the manual for performance 
audits from SAI Netherlands are used as guidelines for the auditors when providing 
constructive recommendations in the report. The SAI also has a note with guidelines 
regarding content for the recommendations that are included in the report. 

There are no standards or policies in place to follow-up on previous audit findings and 


recommendations. 


Dimension (ii): Performance Audit Team Management and Skills 


This dimension examined whether the SAI established a system for ensuring that their 
audit staff that conducts performance audit, collectively possess the professional 
competence, skills and experience necessary to carry out the audit in question. 

SAI Aruba has not established a system to ensure that the audit team has the necessary 
professional competence to conduct performance audits. 

Below we will summarize the findings for this dimension and present what the SAI has 
done to ensure that the audit staff conducting performance audit team has the competence 


and skills to carry out such audits. 


There was not sufficient evidence regarding the audit’s team understanding of the 
applicable auditing standards and the knowledge of research design, social science 
methods, and evaluation techniques. However, in the last years, some auditors had the 
opportunity to take some courses and participate in seminars on the topic of performance 
audit. 

A decision was made by the Head of SAI to give the SAI auditors the opportunity to, under 
guidance, prepare a Personal Development plan (POP) on the areas they need to improve 
and develop with time. This Personal Development plan did, however, focus more on the 
staff needs rather than on the SAI needs. The SAI did not include in the Personal 
Developing plan the need for developing the staff skills in performance audit. 


The SAI also has no established system in place to ensure that the team has the sound 
knowledge of government organizations, programs, and functions, as ISSAI 300 indicates. 
In the past, Aruba's government provided civil servants the opportunity to follow a course 
regarding all aspects of the government organizations, laws, and administrative process. 
Since 2012, this course is not taking place anymore. The SAI self does not have a system 
internally that ensures that the auditors have the sound knowledge of government 


organizations, programs, and functions; apart from the staff’s own experience. The audit 
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staff has gained experience in government organizations by executing several 


investigations and monitoring the field. 


When carrying out a performance audit, there is also no system in place to guarantee 
personal strengths such as analytics, writing, and communication skills. However, the SAI 
has internal instruction documents that contain guidelines on the content of the note on 
findings and the reports. These guidelines are however, not specifically tailored for a 
specific audit type and are not followed by all auditors. The SAI also has organized general 


courses on improving the writing skills and communicating more effectively. 


ISSAI 300:31 states that the SAI should also have a system in place to ensure that the 
audit team has the ability and experience to exercise professional judgement. This aspect 
is mentioned in the principles of the SAI's code of ethics, but there is no system in place 
to guarantee it. In practice, the auditors have gained experience during the years in having 
an objective attitude by conducting several investigations, and from the support they 
received from SAI Netherlands. The auditors are also allowed to carry out tasks beyond 
their functions, which contributes to their experience and enhancement of their 
professional judgment capacity. 

For this dimension, the team also assessed if the SAI has clear reporting lines and 
allocation of responsibilities within the audit team. The SAI has an organizational 
handbook that consists of the SAI's organogram, including the functions hierarchy and the 
auditors' reporting lines and responsibilities. Due to the lack of personnel and not having 
all vacancies filled, it is not possible to follow the reporting lines described in the 
organizational handbook. Many auditors have to fulfilled different roles and the role may 
vary for each audit e.g., a researcher may have a research leader's role for a specific audit 


and then a researcher role for in another audit. 


Since the SAI has not yet adopted the audit standards for performance audits, there is no 
evidence that the SAI provides support to implement the standards or to help develop the 
auditor's professional skills for performing performance audits. The received support from 
the SAI is more general and not specifically tailored to performance audits. In the past 
years, the SAI has provided support to its auditors in the form of ISSAI guidance materials 
or courses on developing the audit objectives and audit questions related to the principles 
of economy, efficiency, and effectiveness. The SAI has also provided support on 
establishing suitable audit criteria that correspond to the audit questions. However, the 


acquired knowledge has not been materialized into audit procedures. 


This dimension also examined whereas the SAI provides support to the auditors on how 
to design the audit procedures to gather sufficient and appropriate audit evidence and on 
how to apply different data gathering methods according to the ISSAI standards. No 
evidence was found that the SAI provided support on these specific areas, but in the past 
the SAI has provided the audit staff access to experts from the Netherlands for support 
on these areas. SAI Netherlands also has provided support on how to evaluate the audit 
evidence in light of the audit objectives and on the writing audit recommendations that 


are well-founded and add value to the audit. 
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Dimension (iii): Quality Control in Performance Audit 

According to this dimension, quality control describes the sum of the measures taken to 
ensure the quality of each product and that it is carried out as an integrated part of the 
audit process. Below we will summarize the findings on how the SAI measures the quality 


control for performance audits and how they are implemented in practice. 


The SAI does not have a written procedure for all work carried out by the SAI that is 
subject to review to contribute to the quality and promote learning and personnel 
development. In practice, there is a review that takes place by different auditors within 
the SAI. However, it is not completely according to the standards of the performance 
audits. 

The review takes place from the researcher to the research leader and research leader to 
the project leader. The audit work is afterward reviewed by the Secretary-General and the 
Head of SAI. The research leader or project leader also reviews the audit plan, the note 
on findings, the reports, the audit evidence, and evidence documentation. There are no 
specific procedures for performance audit in place that the auditor can go through to 
safeguard the quality and ensure that the applicable quality requirements are met. 
However, guidance from the Netherlands can be provided when necessary, and on upon 


request by the audit team. 


The SAI has implemented a new code of ethics that includes creating a safe environment 
for feedback. The auditors should respect the opinions of others and accept reasonable 
disagreements about the work. The code of ethics also mentions that auditors should give 
feedback in a respectful, honest, and constructive manner. The efficacy of these aspects 
have not been tested yet, since the code of ethics was recently introduced. However, the 
quality of the report under review was guaranteed by having guidance from an expert 
from the Netherlands with ample experience as a project leader. 

Where difficult or contentious matters arise, the SAI does not have a procedure in place 
to ensure that appropriate resources are used to deal with such matters, as indicated by 
ISSA 40. In practice, the SAI first ensures to resolve any difficulties or contentious matters 
internally. The SAI also ensures to have an expert in the team that can assist the team 


members during the audit and helps the team if any difficult or contentious matters arise. 


Part of this dimension also examined whereas there are procedures in place for authorizing 
reports to be issued. The SAI has a procedure in place for authorizing the final reports to 
be issued. The rules of procedures state that the Head of SAI has to authorize final reports 
that are issued. The rules of procedures also state that all documents, should be signed 
by both, the chairman of the Head of the SAI and the Secretary-General, before they are 
sent. This procedure also counts for the authorizing of reports. 
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Assessment Findings and Observations 


Dimension Findings eee a 


All criteria were not met. 


(i) Performance 
teh eace|ee =a) | Phe SAI has not formally adopted any standards and policies for conducting 


Policies performance audit. Therefore all the criteria were assessed as not met. 





All criteria were not met. 

(ii) Performance 

Audit Team The SAI does not have an established system for ensuring that members of a 
Management and performance audit team collectively possess professional competence, skills, 
Skills and experience. 

Since the SAI has not yet adopted the audit standards for performance audits, 
it has not provide sufficient support to the auditors on how to implement the 
audit standards. 





Criteria f have been met. 


(iii) Quality Control Criteria a, b, c, d, and e have not been met. 


in Performance 
Audit The SAI does have procedures in place for authorizing reports to be issued. The 


Head of SAI gives the authorization of issuing of final reports. The rules of 
procedures also states that all document should be signed by both, the 
chairman of the SAI and the Secretary-General, before they are send. Which is 








also the case when authorizing reports to be issued. 








4.3.6 SAI-13: Performance Audit Process - Score 3 


This indicator looks at how performance audits are carried out in practice. 
It assesses three dimensions: 

(i) Planning Performance Audits. 

(ii) Implementing Performance Audits. 

(iii) Reporting of Performance Audits. 


The assessment of SAI-13 is mainly based on the report Public Private Partnership, year 
2019. Other sources and files used were: 


e Audit proposal: Public Private Partnership. 

° Note on findings Public Private Partnership. 

e Text plan Report Public Private Partnership. 

e Letter audit announcement Public Private Partnership. 

e Follow up response letter from audited entities. 

° Code of Ethics SAI Aruba 2020. 

e Integrity Policy plan 2020. 

e Work plan Public Private Partnership. 

e Note on assistance for the investigation on the Public Private Partnership from the professor 
Dr. C. van Montfort. 

e Document on the record of activities - Investigation on Public Private Partnership. 


For the years under review, the SAI did not conduct audits that has all the characteristics 
of performance audit. For the file under review, the audit on Public Private Partnership is 
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the only one that is partially in line with a performance audit's characteristics, and 
therefore was selected. Since SAI Aruba conducts performance audits, but has not yet 
adopted the ISSAI standards, we assessed the dimensions of SAI-13 also as conservative 
as possible, which mean that if there was any doubt in the available evidence the criteria 


was assessed as not met. 


Dimension (i): Planning Performance Audits 


For this dimension, the team assessed how the performance audit's planning phase is done 
in practice. The assessment was based on the audit on the Public Private Partnership. 
Below we will summarize the findings on how the planning is done in practice. 

Before starting the audit, auditors have to conduct a pre-study on the topic. This pre- 
study concludes with an audit proposal that includes background information, audit 
objectives, questions, criteria methodology, and other practical information to carry out 
the audit. The audit team also conducts an extensive analysis of the subject matter, but 
does not fully consider the specific type of audit by clearly mentioning which principle was 


applied. 


ISSAI 300 states that auditors should analyze potential audit topics and conduct research 
to identify risks, problems and materiality. The auditors of SAI Aruba monitor all 
government departments during the year and prepare a risk analysis. The risk analysis 
serves as a tool for topic selection, while taking into account the various aspects. 

However, during the planning for the audit under review, the auditors did not consider 
materiality when defining the objective, audit criteria, evaluation of audit evidence, 
documentation, and risk management. Materiality was considered when choosing topics 


within the audit, by looking at important contract management aspects. 


The team did not find sufficient evidence that the auditors clearly-defined the audit 
objective that relates to the principles of economy, efficiency, and effectiveness. This is 
an important aspect when planning for a performance audit. Also, these principles were 
not taken into consideration in the audit objective. The audit objectives were framed as 
an overall audit question and broken down into more precise sub-questions. To facilitate 
the audit design's soundness, the auditors took some aspects of a problem- and system- 
oriented approach, however, these were not clearly defined. 

When planning, the auditors did apply suitable criteria that correspond to the audit 
question and sub-questions. However, they were not clearly related to the principles of 
economy, efficiency, and effectiveness. Also, the auditors did not discuss the applied 
criteria with the audited entities, as addressed by ISSAI 300, even though the criteria was 


communicated to them. 


ISSAI 300 also states that when planning the audit, the auditors should design the audit 
procedures that will be used for gathering audit evidence. In the audit proposal, the 
auditors did not document in detail which procedures were used for gathering audit 
evidence, as this is described in the work plan. The planning of the audit did, however, 
contain the methods used for obtaining evidence. When planning the audit, the auditors 
did also not assess the risk of fraud. 
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Since the SAI does not currently have a project leader, an external project leader was 
hired. The cost of the external project leader was considered in the planning. 

During the period under review, the SAI did not have a system to ensure that any 
contractors comply with the ethical requirements. The external expert that was hired for 
this audit under review did, however, sign a confidentiality agreement. The confidentiality 
agreement described all the ethical requirements that the contractor should consider when 
working with the SAI. 


Dimension (ii): Implementing Performance Audits 


In this dimension, the team assessed how the performance audit's implementation phase 
was set out in practice. The assessment was based on the audit on the Public Private 
Partnership. Below we will summarize the findings on how the audit was carried out in 


practice. 


Assessment on report Public Private Partnership 

The assessment results indicates that, the auditors obtained sufficient appropriate audit 
evidence during the audit, to establish the findings, reach conclusions in response to the 
audit objectives and questions, and issue well-funded recommendations. The audit 
evidence can be traced from the audit proposal to the note on findings to the report. 
Before the report was written, the auditors evaluated the audit evidence, and prepared a 
note on findings. The obtained evidence was also documented, compared and analyzed, 
with the means of obtaining findings. The importance of the findings and the extent to 
which they were relevant enough to include in the note on findings were discussed within 
the team and ultimately decided by the project leader. The evidence was also evaluated 


regularly and all evidence can be traced back to the audit documentation and audit files. 


For this audit, the auditors combined and compared different data from different sources. 
The data was obtained from interviews, including the under lying documents, the financial 
information system and the contract management system. Based on the findings, the 
auditors used their professional judgment, derived from their experience in the SAI to 
reach conclusions and answers to the audit questions. 

Based on the evidence that gathered during the interviews, the auditors prepared a note 
on findings. The note on findings includes the necessary information on which the 
conclusion is based and is placed into context to answer the audit questions. All relevant 
and substantiated findings are included in the report. 

The writing process of the report includes the consideration of the argument and begins 
with a writing plan. Along the way, the writing plan is edited based on the feedback from 


the project leader. 


The report under review, did not included a series of analytical processes that evolved 
gradually throughout the audit, as ISSAI 300 indicates. Mainly because the objective of 
the audit was not an in-depth performance audit. 

As it is addressed by ISSAI 300, a high standard of professional behavior was maintained 
throughout the audit process by hiring an external expert with knowledge on Public Private 
Partnerships and with many years of experience at the SAI Netherlands. The external 
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expert guided the team throughout the audit, to work systematically, with due care, and 
objectivity. 


For this dimension, the team also assessed how the auditors managed audit risks 
throughout the audit. The auditors managed the risk of providing incorrect conclusions 
and information by given the audited entity the opportunity to provide feedback and 
comments on the evidence and information gathered. The audit team managed the risk of 
misinformation by analyzing the information from different sources and aligning it with 
the formulated criteria in the audit plan. 

For the audit under review, the auditor did not carry out an in-depth risk analysis in the 
audit plan, but the audit procedure did contain elements to mitigate risks. 

During the audit, the audit team also considered materiality too some extent. The audit 


was therefore expanded with new topics that seemed to be of importance to Parliament. 


For this dimension we also assessed the communication throughout the audit. The 
assessment indicates that the auditors maintained effective and proper communication 
with the audited entity during the audit, and they were informed properly after completing 
each phase of the audit process. There was however, no effective or proper communication 
with Parliament as a key stakeholder, which is a criteria addressed by ISSAI 300. 

Other aspects of communication were well covered and were met when referring to the 
assessment criteria. During the first interview at the beginning of the audit period, the 
auditors presented themselves properly. The auditors explained to the audited entity the 
audit's objective, timeline, and what they could expect during the audit. A note of the 
findings, based on evidence gathered, was also sent to the audited entities for feedback. 


In the opinion of the SAI PMF team, the audit documentation was sufficiently detailed. 
However, since the audit documentation has not been reviewed by another experienced 
auditor, there is no assurance on the completeness of the gathered information. All 
findings, conclusions, and recommendations are backed up by relevant evidence and 
documentation. A master file contains all the evidence, received information, audit 


documents, and correspondence can be reviewed by another auditor. 


Dimension (iii): Reporting on Performance Audits 


In this dimension, we assessed the reporting phase of the performance audit. The 
assessment was based on the audit on the Public Private Partnership. Below we will 


summarize the findings on how the reporting was carry out in practice for this audit. 


The report on the Public Private Partnership was carried out in the form of a descriptive 
investigation, and as mentioned earlier it was partially in line with the characteristics of a 
performance audit. The objective of the report was to identify the risks and elaborate on 
the management of the projects. The auditors also audited the effectiveness of 
communication by analyzing the sharing of information with Parliament. When auditing 
the contract management some aspects of effectiveness were considered, but not to the 
extent of being a performance audit, and it was not identified as such. Also, the 


performance audit principle that was chosen was not clearly defined and substantiated. 
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Assessment on the reporting 

When reporting the auditors strived to write as comprehensive as possible. In recent 
years, auditors also strived to report in a more reader-friendly manner by formulating 
simpler and shorter sentences. This was done with the help of writing courses and with 
guidance from the external project leader. Also, by including more illustrations and 
graphics in the report, the auditor strived to make it more attractive and reader-friendly. 
However, the SAI has not conducted any survey to assess the reader friendliness of the 


report after it was published. 


When reporting, the auditors strived to addressed all relevant information and ensured 
that the audit questions were answered and the audit objective was met. The auditors also 
did guaranteed that the report was logically structured with a clear relationship between 
the audit objective and the rest of the report. 

This dimension also assessed the quality control process for the report under review. The 
results indicate that the report went through some quality control process, but not to the 
extent as required by ISSAI 300. The external project leader and the Secretary-General 
are responsible for the quality and assessed whether there was a clear relationship 


between all the separate parts included in the report. 


The auditors also strive that the audit report is well-balanced by writing a note on findings 
that is very factual in nature. The note on findings is primarily a description of all findings, 


aimed at completeness, without attaching any recommendation or conclusion. 


The external project leader also did a writing plan for the report to ensure that it is well- 
balanced. The report contained a translation of the note on findings into a story with a 
clear line of arguments in which the main message was central. Only the findings that 


were relevant in the light of the conclusions and recommendations were used in the report. 


For the reporting phase, we also assessed whereas the auditors considered materiality. 
The auditors considered materiality on the findings that at that moment were relevant and 
could have an influence. The team also found sufficient evidence that the report included 
information regarding the criteria and their sources. This information was included in the 
appendix of the report. The auditors provided constructive recommendations for 
addressing the weaknesses or problems identified by the audit. The recommendations 
were based on the findings of the audit. The recommendations were addressed to the 
ministers responsible for the audited entity and Parliament, regarding what steps to take 


to address the problem at hand. 


The audited entities were given the opportunity to provide their comments on the note on 
findings. The corresponding minister had the opportunity to provide comments on the 
conclusions and recommendations included in the final report. The minister is ultimately 
responsible for the audited entities and can consult his audited entities regarding the 


conclusions presented by the SAI. 


The last aspect the team assessed for this dimension was how errors in evidence were 
managed. In the draft version of the note on findings, the audited entity provided 
comments on the findings by the auditors. The auditors analyzed and adapted these 
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findings. All changes were sent back to the audited entities and included in the audit 
documentation. The note on findings was resent to the audited entities and the comments 
were processed. As SAI Aruba conducts performance audits, but has not yet adopted the 
ISSAI standards, the SAI did not include a declaration on the standards when conducting 
the audit. 


Assessment Findings and Observations 
Dimension Findings (Pee 
8) criteria b, e, g, i, k, and | have been met. 2 
(OMAEnn I) Criteria a, c, d, f, h, j, , and m have not been met. 
Performance Audits 
The audit on Public Private Partnership was partially in line with the 
characteristics of a performance audit. The SAI conducts performance audits, 
but has not yet adopted and implemented the ISSAI standards. The auditors 
analyzed the audit topics and identified risks and problems. The audit 
objectives can be framed as an overall audit question. Prior to the audit, the 
auditors evaluated whether and in what areas external experts were required. 





Criteria a, b, c, d, e, g, h, and i have been met. 3 


(ii) Implementing Criteria f, j, and k have not been met. 


Performance Audits 


Even though SAI Aruba has not adopted and implemented the ISSAIs for 
performance audit, in practice the SAI meets most of the criteria in this 
dimension. 

The auditors obtained audit evidence and evaluated them to obtain audit 
findings. The data was compared to different sources. Also, the auditors 
exercised professional judgment on the findings to reach a conclusion. The 
audit evidence was placed in context. Throughout the audit process, a standard 
of professional behavior was maintained. Also, the auditors managed audit risk 
and considered the materiality throughout the audit process. 





Criteria b, c, d, e, f, g, h, i, k, and | have been met. 3 
(iii) Reporting on Criteria a and j have not been met. 

Performance Audits 

The auditors strived to provide an audit report, which is comprehensive, 
convincing, reader-friendly, and balanced. Also, the auditors did consider 
materiality during the audit process to the extent of the SAI. The report 
included information about the audit criteria, conclusions to answer the audit 
question, and recommendations. The audit entities had the opportunity to 
comment on the audit report. The disagreements in the findings were analyzed 
and corrected. 














4.3.7 SAI-14: Performance Audit Results - Score 4 


This indicator relates to performance audit outputs. 


It assessed three dimensions: 

(i) Timely Submission of Performance Audit Reports. 

(ii) = Timely Publication of Performance Audit Reports. 

(iii) | SAI Follow-up on Implementation of Performance Audit Observations and 


Recommendations. 


SAI Performance report of SAI Aruba 


The assessment of SAI-14 was mainly based on the report Public Private Partnership, year 
2019. 

Other files used were: 

e Letter offering Public Private Partnership report to the legislature. 

e Screenshot published report. 

. Letter follow-up recommendations of the report of Public Private Partnership. 

e Follow-up response Letter from audited entity. 


° Letter to Parliament. 


For the years under review, SAI Aruba did not conduct audits with all the characteristics 
of a performance audit. The audit on Public Private Partnership was selected for the file 
under review, because it is partially in line with a performance audit's characteristic. Since 
SAI Aruba conducts performance audits, but has not yet adopted the ISSAI standards, 
these dimensions were assessed as conservative as possible. This provides a realistic view 


of what is in place and the areas that needs improvement. 


Dimension (i): Timely Submission of Performance Audit Reports 

For this dimension the team assessed if the performance audit report was submitted to 
the appropriate authority in a timely manner. The authority is responsible for considering 
the report and taking appropriate action. The report under review was submitted to 
Parliament and the relevant minister, within 15 days of completion of the audit. The 
completion of the audit was dated 14 November 2019, and the report was submitted to 
Parliament on 25 November 2019 and to the minister of Infrastructure on 26 November 
2019. 


Dimension (ii): Timely Publication of Performance Audit Reports 

This dimension assessed if the performance audit report was widely accessible and 
presented to the general public. The National Ordinance Court of Audit Aruba states that 
the report can be published after it is submitted to Parliament. The day after the report 
was submitted to Parliament, it was published in all newspapers, online news media, and 
on the SAI’s website. The report was sent to Parliament on 25 November 2019, and 
published on 26 November 2019. 


Dimension (iii): SAI Follow-up on Implementation of Performance Audit 
Observations and Recommendations 

In this dimension, the SAI PMF team assessed if the SAI did a follow-up to keep track of 
the provided audit findings and recommendations. For the first time the auditors carry out 
a follow-up on the audit findings and recommendations. The follow-up took place six 
months after the report was published. In the follow-up, the auditors focused on the 
actions that took place during the six-month period and whether the audited entity had 
addressed the problems. As part of the follow-up, a letter was send to inform the Minister 
and Parliament on the actions taken by the audited entities. The letter included the 
progress made and also the lack of corrective actions that were taken and the 


shortcomings that were identified. 
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The SAI does not have any follow-up standards or procedures to allow the audited entity 
to provide information on corrective measures taken or why corrective actions were not 
taken. 

The SAI has also not established practice to evaluate materiality or identify the follow-up 
problems, to decide if an additional audit needs to take place. There is no standard or 
system in place on how an auditor should assess materiality or identify problems during 
the follow-up phase. 


Assessment Findings and Observations 





The report on Public Private Partnership was submitted to Parliament and the 
(i) Timely Minister within 15 days of completion of the audit. Therefore the score for this 
Submission of criteria was considered a four. 

Performance Audit 

Results 


Dimension Findings fee 





The SAI published the report on Public Private Partnership within 15 days after 
(ii) Timely it was permitted to be published. Therefore the score for this criteria was 
Publication of considered a four. 

Performance Audit 

Results 





Criteria a, b, c, e, and f have been met. 


(iii) SAT Follow-up Criteria d and g have not been met. 


on Implementation 
Ayo eee utee s\tefi2 | The auditors did a follow-up on the audit findings of the report on Public 


Observations and Private Partnership. The follow-up did focus on whether the audited entity had 
Recommendations adequately addressed the problems. The follow-up report includes all relevant 
corrective action taken. Also, the follow-up report is reported appropriately to 
provide feedback to the legislature. The results of the follow-up report were 


reported individually. 














4.3.8 SAI-15: Compliance Audit Standards and Quality Management - Score 1 


SAI-15 seeks information on the level of compliance with available standards and other 
relevant guidance. It also assessed the competencies and experience of the personnel 
doing these audits. 

This indicator has three dimensions: 

(i) Compliance Audit Standards and Policies. 

(ii) Compliance Audit Team Management and Skills. 

(iii) Quality Control in Compliance Audits. 


The assessment of SAI-15 was mainly based on the following documents: 

e Document of Rules of procedure of SAI Aruba (1998). 

e Manual report (January 2007 and 2011) and guideline under content for the note on findings 
and the report. 

e Audit proposals: National Financial statement 2017 and 2018. 

e Integrity Policy plan 2020, work plan for the National Financial statement 2017 and 2018. 

e Document on the record of activities - Investigation on the National Financial statement 
2018. 
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e Report: Investigation on the National Financial statement of 2017 and 2018. 


Dimension (i): Compliance Audit Standards and Policies 


As with the two other audit types, SAI Aruba has not yet adopted the ISSAI standards 
(ISSAI 400) for conducting compliance audits. However, as it was for performance audits, 
auditors do make use of manuals from SAI Netherlands as a guideline on how to determine 
elements such as subject matter, subject criteria, and audit scope. These elements are 
addressed by ISSAI 400, which should be identified by the auditor before starting with the 
audit. To some extent, the manuals used from SAI Netherlands are in line with ISSAI 400, 
but do not specifically refer to it. These manuals have also not been formally adopted by 
the Head of SAI. 

As with the other audit types, auditors are required to submit audit proposal to the Head 
of SAI for approval. The audit proposal includes many elements of compliance audit, 
according to the ISSAIs, such as applicable authorities, subject matter, and intended users 
of the report. Some elements such as the level of assurance and the propriety 
requirements are, however, not included in the proposal. There is also no documentation 


or policy in place that states the auditors are required to include these elements. 


Since SAI Aruba conducts compliance audits, but has not yet adopted and implemented 
the ISSAI standards, the dimensions of SAI-15 were assessed as conservative as possible. 
This way it gives a realistic view on what there is in place and the areas that need to be 
improved if the SAI wants to adopt the ISSAI standards for conducting compliance audits. 
Below we will summarize the findings for this dimension and present them per principle 


as it was covered in this dimension and addressed by ISSAI 400. 


Audit risk (ISSAI 400:46) 

The SAI does not have any written standards and policies in place to actively manage 
audit risk, and to ensure the auditors consider the different types of risks: inherent, 
control, and detection risk, throughout the audit process. The auditor also does not 


specifically include fraud risk factors in risk identification. 


Materiality (ISSAI 400:47) 

The SAI does not have any written standards and policies in place that describe how 
materiality should be considered at all stages of the audit process. If taken into context 
materiality aspects such as value, nature and aspects, were considered in practice, during 
the monitoring of audit topics and when preparing the audit proposal. The materiality 
aspects were, however, not clearly defined in the available documentation, nor is there a 


written procedure in place on how auditor should determine materiality. 


Documentation (ISSAI 400:48) 

There are no written standards or policies on how the auditors should prepare audit 
documentation. The auditors keep an audit file for each investigation, but this audit file 
does not specify the criteria used, the judgments made, the evidence obtained and how 
the conclusion was reached. For compliance audit, however, the criteria applied by the 


auditors is the existing regulations and legislations. 
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Communication (ISSAI 400:49) 

The SAI has no written standards or policies on how the auditor should communicate 
throughout the audit. Normally, before each audit as for all audit types, the corresponding 
minister is informed through a formal letter that an audit will take place on their 
subordinates’ entities. The minister in turn may send a letter to their department asking 
for collaboration during the audit. 

The audit team will then contact each department by mail or phone to set up an interview. 
During the interview, the audit team communicates the content and the process of the 
audit. 


Subject matter and criteria (ISSAI 400:51) 

The SAI has no written policies or procedures on how the auditors should identify the 
subject matter and criteria. However, each audit proposal includes both a subject matter 
and audit criteria. Since the SAI has no standards for identifying the subject matter and 
criteria, the auditors cannot ensure whereas these were properly identified. The manuals 
that auditors use from SAI Netherlands, will assist them in the identification of the subject 


matter. However, these manuals have not been approved by the Head of SAI. 


Audit scope (ISSAI 400:50) 
The SAI has no written standards in place on how the auditors should determine the audit 
scope. Normally, the auditors are free to determine the audit scope. The guidelines and 


manual from SAI Netherlands assist the auditors in the identification of the audit scope. 


Understanding of audit entity and their control environment (ISSAI 400:51 and 53) 
There are no written standards and policies that describe 'the extent of understanding’ 
that the auditor should have on the entities and their control environment. It is expected 
that the auditor has a basic understanding of the governance structure and authorities. 
This is one of the requirements when applying for a position at SAI Aruba. 

For the reports under review, the auditors did have a clear understanding of the structure 
and operations of the audited entities, but did not cover all aspects of the applicable 


authorities, and the control environment was not clearly defined. 


Audit strategy and audit plan (ISSAI 400:56) 

The SAI has no written standards in place that address how the auditors should develop 
an audit strategy and audit plan. The auditors do prepare a audit proposal and a work 
plan, but do not consider the response and risk of non-compliance, which is the audit 


strategy's main objective. 


Audit evidence (ISSAI 400:57) 

The SAI has not established written standards that describe what is considered as 
sufficient and appropriate audit evidence. Manuals from SAI Netherlands are being used 
as guidelines for the gathering of audit evidence. 

During the investigations, the auditors conduct several interviews and collect the needed 


evidence and supporting documentation to answer the audit questions. 
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Auditors also gather information to the extent of what is available and use different 
sources, based on their own practical experience. Auditors are required to gather as much 
evidence as possible and support all what is mentioned during the interviews with relevant 


information. 


Reporting (ISSAI 400:59) 

The SAI has no written procedure in place to ensure that all the principles of completeness, 
objectivity, timeliness, and a contradictory process are covered in their report. The SAI 
uses the manuals from SAI Netherlands. These manuals are broadly in line with the 
principles for reporting of compliance audit. In practice auditors ensure that the reports 
are fully covered, are objective as possible, and that the audits are conducted in a timely 


matter. 


Implementation of audit standards 

The SAI PMF assessment criteria states that the SAI should also adopt policies and 
procedures on how it has chosen to implement the audit standards. Since the SAI has not 
adopted the compliance standards yet, there are no policies and procedures in place on 


how the audit standards should be implemented and what they should cover. 


Dimension (ii): Compliance Audit Team Management and Skills 


This dimension assesses, whereas the SAI has a system in place that supports the audits 
teams to determine the type of audits, the applicable standards, the audited entities, 
exercising professional judgment, identifying authorities, and determining the risks 
associated with the audit. During the assessment, the team found no evidence that SAI 
Aruba has a system in place, to ensure that its auditors possess the required knowledge 
and skills to conduct compliance audits. Due to the size of the SAI the expectation to have 
an established system is low. The SAI expects the staff and allow the staff to have the 
proper education, skills, and knowledge. However, this is not according to a system that 


guarantees a collective possession of all skills. 


When forming the audit team for a compliance audits, the auditors’ experience is 
considered. The SAI has set up a Personal Development plan to upgrade the professional 
skills of the auditors. However the plan does not focus on gaining the necessary knowledge 
on the elements of a specific audit type, such as compliance audit. 

The knowledge and skills that the auditors have, is derived from their own experience and 
education, which is set as a requirement for a function within the SAI. Some auditors have 
gained the required experience being part of the investigation on the national financial 
statement for many years. The auditors’ experience throughout the years have also helped 


them gain the necessary professional judgment and knowledge on the audited entities. 


When auditing compliance, the auditors follow the existing laws and regulations set by the 
government of Aruba. Over the years, the auditors gained the necessary knowledge on 
using the existing laws and legislation when investigating the national financial statement. 


If needed and required, the auditors can also request for support from external parties. 
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In the past, the auditors received guidance and support from external experts in the audit 
field. 


Other than the auditor’s experience throughout the years, no evidence was found that SAI 
Aruba has provided appropriate guidance to its auditors for certain elements when auditing 
compliance. In the past the SAI hired experts to assist the audit team in compliance audit, 
but did not achieve the results that were expected. There is no evidence that the auditors 
have received guidance on how they should identify suitable criteria for evaluating audit 
evidence or determine the level of assurance and consider the different dimensions of 
audit risks. The SAI has also not provided the auditors with guidance on including risk 
factors in the risk assessment or developing an audit strategy and audit plan when 
planning for a compliance audit. When preparing the report, the auditors have received 
tailor-made courses from external experts on how to write comprehensive and reader- 
friendly audit reports. The analytical process was also captured in these courses, and also 
there is guideline available from SAI Netherlands. However, the auditors did not receive 
specific guidance on how to write compliance audit reports, that includes the elements 
addressed in ISSAI 400:59. It depends mostly on the level of writing skills that each 


auditor possesses. 


Dimension (iii): Quality Control in Compliance Audits 

When assessing this dimension, the team did not find sufficient evidence that the SAI has 
implemented quality control measures for compliance audits. In practice however, some 
quality control activities take place to ensure the quality of the work. For instance, all 
work carried out is reviewed by a different staff member. Research leaders and project 
leaders review the audit team members' work, where after the audit team's work, the 
audit proposal, the note on findings, and the report, is reviewed by both the Secretary- 
General and the Head of SAI. The research leader and project leader have to ensure that 
the audit evidence is sufficient, relevant, appropriate, and that there is a proper 
documentation of the evidence. 

The SAI has no written procedures or provides the auditors with guidance on how the 
review process should take place and the elements that are important during the review. 
The SAI also has no policy in place on 'whether and when' a review of the whole audit 
report should take place, and by whom. For instance, there is no policy in place that the 
audit review should be carried out by an expert within the SAI, that was not involved in 
the audit. 


As it was for the other two audit types, the SAI has a procedure in place for issuing the 
audit reports. The Head of SAI and the Secretary-General are responsible for authorizing 
the issuing of any reports final draft reports. The Rules of Procedures manual also states 
that all letters and reports should be signed by both the chairman of the SAI and the 


Secretary-General before they are sent to an external party. 


The SAI PMF criteria states that the SAI should ensure that appropriate resources are used 
to deal with difficult or contentious matters. SAI Aruba first ensures to resolve any matter 


internally. The SAI has never encountered a situation where external technical expertise 
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was sought during an audit. However, if it is necessary, before the investigation, the SAI 
shall ensure to contact the appropriate external resources. 


Assessment Findings and Observations 
Dimension Findings 


All criteria were not met. 

(i) 

Compliance SAI Aruba has not adopted audit standards aligned with the fundamental principles of 
Audit compliance audit, as set out in ISSAI 400. Also, the SAI has no policies and procedures 


Standards that interpret the standards in the individual SAI context. 


and Policies 





Criteria a, d, and e have been met. 

(GD) Criteria b, c, f, g, h, I, j, k, |, m,n, 0, p, and q have been not met. 

Compliance 

tele seein | All skills and knowledge was acquired from the auditors experience in auditing 
Management compliance. Since SAI Aruba is small, the expectations of having an established system 


and Skills may be lower. 





Criteria a, c, and f are met. 


(i) @lteliis, | Criteria b, d, and e have not been met. 


Control in 
Compliance When difficulties or contentious matters arise during the audit, the SAI first ensures to 


Audit resolve any matter internally. However, if it is necessary, prior to the investigation, the 
SAI shall ensure to contact the appropriate external resources. 

The Rules of Procedure manual states that all internal documents should be signed by 
both, the chairman of the SAI and the Secretary-General, before they are sent. This 


procedure does also hold for the authorizing for the issuing of any reports. 


Not sufficient evidence was found that the SAI has implemented quality control 


measures for compliance audits. 














4.3.9 SAI-16: Compliance Audit Process - Score 1 


SAI-16 seeks information on how compliance audits are done in practice at the planning, 
implementation and reporting stages of the audit cycle. 


This indicator has three dimensions: 


(i) Planning Compliance Audits. 
(ii) Implementing Compliance Audit. 
(iii) Evaluating Audit Evidence, Concluding and Reporting of Compliance Audits. 


Evidence that was used for this dimension were: 


e Investigation on the National Financial statement of 2017. 

° Investigation on the National Financial statement of 2018. 

e Audit proposal: National Financial statement 2017 and 2018. 

° Letter audit announcement National Financial statement 2017. 

° Letter audit announcement National Financial statement 2018. 

e Questionnaire to the Department of Finance date 7 December 2018. 
° Code of Ethics SAI Aruba 2020. 

e Integrity Policy plan 2020. 
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e Work plan National Financial statement 2017 and 2018. 
e Document on the record of activities - Investigation on the National Financial statement 
2018. 


Dimension (i): Planning Compliance Audits 


SAI Aruba has the mandate to report each year on the national financial statement. Each 
year the audit team develops an audit proposal that includes all the topics that will be 
investigated. Many of the topics included in the audit proposal are assessed and ranked 
during the monitoring phase. Some other topics recur each year, as they are compliance 
topics that are laid down in the SAI’s mandate as part of the investigation on the national 


financial statement. 


ISSAI 400, criteria 28-41, describes all the relevant elements that should be identified by 
the auditors, before carrying out a compliance audit. The evidence obtained shows that 
some elements were identified, but there is no system in place to ensure that all auditors 
identify all of these elements. Elements that were included in the audit proposal are 
applicable authorities (regularity), the legislative norm (budget law), the subject matter, 
and the intended users of the report (Parliament). 

The elements of assurance was also considered to some extent in the audit proposal, by 
emphasizing that the investigation on the national financial statement did not include an 


audit or assessment in an audit technical sense. 


The auditors also identified the subject matter for the national financial statement’s 
compliance topics based on the existing regulations, legislature, or agreements. These 
authorities were also the basis for evaluating the audit evidence. 

By conducting a similar investigation each year, the auditors have gained understanding 
in the audited entities and their authorities. For the audited reports under review, the 
auditors were familiar with the structure, legislation, and operations at the audited 
entities. 

There are, however, many elements and principles, where not sufficient evidence was 
found to consider that they were identified by the auditors, when conducting compliance 
audit. For instance, the auditors did not extensively consider audit risk and risk of fraud 
after determining the compliance audit topics and planning the audit. 

Aspects of materiality are considered when reporting. However, not sufficient evidence 
was found on how materiality was determined and if it was identified during the planning. 
The auditors did also not conduct other aspects such as communicating the audit criteria 
with the audited entity and determining whether the audit scope is influenced by 
materiality and risk. 

During the planning phase the auditors also did not develop an audit strategy and the 
audit plan was not created according to the specific risks. The auditors however, developed 
a work plan that included all the activities that were necessary for the investigation, to 
reach any conclusion. The work plan was documented in writing and was used by the audit 


team as guidance during the investigation. 
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When it comes to the ethical requirements for a compliance audit, SAI Aruba has made 
good progress during the last year by developing a code of ethics that covers the ethical 
requirements that auditors need to adhere to when conducting audits. The SAI also 
recently developed a confidentiality agreement that is required to be signed by external 
parties. The confidentiality agreement describes all terms that any contractor should 
consider when working with the SAI. 

At the time of the investigation of the compliance audit files under review, there was 
however, no procedure in place that guaranteed that the auditors and external contractors 


complied with the ethical requirements. 


Dimension (ii): Implementing Compliance Audits 

In this dimension, the SAI PMF team assessed certain elements that should be considered 
during the implementation of a compliance audit and whereas audit procedures were 
followed. For instance, it was assessed if the auditor determined the nature, timing, and 
extend of the audit procedures used and aligned them with the audit criteria and scope to 
obtain sufficient and appropriate audit evidence. The team also assessed how the auditors 
cope with instances of non-compliance, which may indicate fraud, and if the auditors 


gathered sufficient and appropriate audit evidence when reaching a conclusion or opinion. 


According to ISSAI 400, auditors should determine the nature, timing, and extent of audit 
procedures to be performed in light of the criteria and scope of the audit, characteristics 
of the audited entity, and results of the risk assessment. The assessment results indicates 
that the auditors did not conduct a risk assessment and nor was the criteria according to 
the compliance audit standards. Therefore, the nature, timing and extend of the audit 
could not be determined in light of the criteria and results of the risk assessment. The 
audit proposal and work plan does, however, include some elements of nature, timing, 
and extend of the audit. 

The SAI also did not encounter any cases of fraud. In case fraud is identified, the SAI 
applies general procedural laws that states that fraud should be reported to the District 
Attorney's office. This law applies to all public entities that may encounter fraud in their 
workplace. However, the SAI does not have internal procedures in place on the concrete 


steps the auditor should take, when cases of fraud are identified during an audit. 


For the reports under review, we could not ensure if the gathered information was 
sufficient or appropriate. To the SAI PMF team’s opinion and based on both of the 
investigations’ work plan, the evidence collected was sufficient to the extent that it was 
available. Since many of the departments that provided the information do not have an 
internal control process in place, the audit team can also not establish the quality of the 


provided information. 


This dimension also assessed, whereas the planned audit procedures were followed 
properly during the audit. The SAI does not have written audit procedures, but the audit 
plan serves to some extent as the auditor's audit procedure, which includes all activities 


that should take place during the audit. 
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For the investigation on the National Financial statement 2017, all activities were included 
in the work plan, but there was no evidence available on whereas the planned activities 
were performed. 

For the investigation on the National Financial statement 2018, the auditors conducted all 
tasks and recorded them in a document, based on the work plan. The work plan states the 
tasks, responsibilities, and whereas the tasks were performed. No evidence was found 
that the work plan and the conducted activities were approved by those responsible for 
the audit and that the auditor performed a risk assessment when collecting the necessary 


evidence. 


Dimension (iii): Evaluating Audit Evidence, Concluding and Reporting of 


Compliance Audits 


For this dimension, the team assessed the collected evidence, the audit documentation, 
and the different elements included in the report under review. 

No sufficient evidence was found to trace back to whereas the auditors evaluated the 
obtained evidence, based on appropriateness and sufficiency. The auditors evaluate all 
evidence, however, since there are no procedures in place on how it should take place 
when conducting compliance audits, we cannot assure whereas the evidence gathered is 
sufficient and appropriate. 

The SAI PMF team also assessed, whereas there is sufficient information to enable an 
experienced auditor, with no previous connection to the audit, to make a relationship on 
the different components of the audit (subject matter, audit scope, findings, conclusion, 
etc.). Since the report included many topics and not all were compliance topics, it is not 
clear for an experienced auditor to derive from the information in the file report which 
part of the investigations had to do with compliance and which part not. The team also 
did not found sufficient evidence that all elements were included in the audit 
documentation, such as risk assessment, audit strategy, and the results of the procedures 
performed. The SAI has not established audit documentation requirements; however, the 


auditors keep a file report and strive to document as much as possible. 


Also for this dimension, the team assessed, whereas the final report on the National 
Financial statement 2017 and 2018 included elements such as title, scope, identified 
subject matter, etc. The following elements were not included in the final report: 
addressee, identified criteria, applied audit standards, summary of work performed, and 
signature. 

Lastly, the SAI PMF team assessed the communication and writing of the report. As with 
all audits, the audit team maintains a proper communication with the audited entity and 
keeps them well informed. However, not all stages of the audit communication takes place, 
and the auditors do not inform the responsible party of the audit criteria. 

Communication mainly takes place with the entities that are responsible for the central 
administration. If instances of non-compliance are identified the audit team communicates 
directly with the entity. 

To the teams’ opinion the reports are easy to understand and free from vagueness and 
ambiguity. The reports have, however, never been reviewed by an external party to ensure 


that all these elements are met. Since the SAI does not have standards in place to 
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guarantee completeness of their compliance audit reports, the SAI PMF team could not 
assess whereas the criteria on these aspects were met. 


Assessment Findings and Observations 


Dimension Findings oa 


Criteria a, e, and g have been met. 


(i) Planning Criteria b, c, d, f, h, i, j, and k have not been met. 


Compliance Audits 


Elements that were identified and included in the audit proposal were: the 
applicable authorities (regularity), the legislative norm (budget law), the 
subject matter and the intended users of the report (Parliament). 

The element of assurance was considered in the audit proposal by stating that 
the investigation on the national financial statement does not include an audit 
or assessment in an audit technical sense. 

The subject matter for the compliance topics of the national financial statement 
were based on the existing regulations, legislature or agreements and these 
authorities were the basis for evaluating the audit evidence. 


By conducting similar investigation throughout the years, the auditors have 
gained understanding in the audited entities and their authorities. For the 
audited reports under review the auditors were familiar with the structure, 


legislation and operations at the audited entities. 





All criteria have not been met. 

(ii) Implementing 

Compliance Audits The team did not find sufficient evidence that the auditors determined the 
Team nature, timing, and extend of the audit and aligned it with the audit criteria 
and scope. The team could not establish if the gathered information was 
appropriate. 

The SAI does not have written audit procedures, but the audit plan serves to 
some extent as the auditor's audit procedure, which includes all activities that 
should take place during the audit. 





Criteria e and i have been met. 

(iii) Evaluating Criteria a, b, c, d, f, g, h, and j have not been met. 

Audit Evidence, 

Concluding and The audited entity has the opportunity to provide comments to the note on 
Reporting in findings. The recommendations by the SAI are not discussed with the audited 
Compliance Audits entity, but sent to the corresponding minister for their comments. The minister 
in turn can opt to discuss the recommendations with the audited entity and use 
their input. The comment of the minister is included in the report. The minister 
is ultimately responsible for the audited entities. The minister can consult his 
audited entities in regard to the conclusions presented. 


All recommendations are based on the findings of the report and directed to 
the government who is responsible for the implementation. For both reports 
under review there was a different structure on how the recommendations were 
presented. In one of the reports, the recommendations were given to the 
government as a whole, whereas for the other report a _ separate 
recommendations was given to the Minister of Finance, Parliament and 
government. 
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4.3.10 SAI-17: Compliance Audit Results - Score 2 


SAI-17 assesses how efficient the SAI is in the submission and publication of its reports. 
This SAI seeks information on how compliance audits are done in practice at the planning, 


implementation and reporting stages of the audit cycle. 


This indicator has three dimensions: 


(i) Timely Submission of Compliance Audit Results. 
(ii) Timely Publication of Compliance Audit Results. 
(iii) SAI Follow-Up on Implementation of Compliance Audit Observations and 


Recommendations. 


The assessment of SAI-17 is mainly based on the final reports: investigation on the 
National Financial statement of 2017 and 2018, and the accompanying letters when both 
reports were published. 


Dimension (i): Timely Submission of Compliance Audit Reports 


This dimension assessed if the compliance audit reports were submitted to the appropriate 
authority in a timely manner. The authority is responsible for considering the report and 
taking appropriate action. The SAI has a legal obligation to submit a review report of the 
national financial statement within 12 weeks after the national financial statement is 
received by the SAT. 

From the two reports under review, only the report on the investigation of the National 
Financial statement for the year of 2017, was submitted to Parliament within the 
established legal time frame, which is 12 weeks, after receiving the national financial 
statement. The report on the National Financial statement 2018 was not delivered on time, 
but was mainly due to a delay in receiving a reaction from the minister, that was necessary 


to properly complete the investigation. 


Dimension (ii): Timely Publication of Compliance Audit Reports 
This dimension assessed the time span and communication channels used for both reports 
under review. Both reports under review were made public through the appropriate means 


(website/newspapers/online media) within 15 day after they were send to Parliament. 


Dimension (iii): SAI Follow-up on Implementation of Compliance Audit 


Observations and Recommendations 


For this dimension, the SAI PMF team assessed, whereas the SAI has a follow-up system 
and if the SAI takes into account the feedback received from the audited entities. 

SAI Aruba does not have a follow-up system to address the observations and 
recommendations in the compliance audit reports. The final report includes 
recommendations to the ministers and Parliament. However, no evidence was found that 
the SAI did a follow-up in the same year. Most of the investigating topics relating to 
compliance are in practice addressed again every year and are reassessed. When reporting 
in the following year, the SAI then refers to previous recommendations, so the legislature 


can notice whereas correctives measures were taken. 
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The SAI PMF criteria states that the SAI should have a follow-up procedures that allows 
the audited entity to provide information on corrective measures taken or why corrective 
actions were not taken. SAI Aruba does not have such follow-up procedures in place. Since 
the investigation on the national financial statement is conducted every year, the auditors 
follow-up on the comments provided by the minister in the next year report. The team did 
not found evidence that the SAI has a practice for evaluating materiality and conducting 


new additional investigations/audits after a follow-up occurs. 


Assessment Findings and Observations 


Dimension 


(i) Timely 
Submission of 
Compliance Audit 
Results 


(ii) Timely 


Publication of 


Compliance Audit 


Results 


(iii) SAT Follow-up 
on Implementation 
of Compliance Audit 
Observations and 


Recommendations 





Findings 


Criteria for score 2 have been met. 


Evidence on receipt of national financial statement: Offering of the National 
Financial statement 2017, September 10, 2018. 

Evidence for the timely submission: query letter investigation on the National 
Financial statement 2017; dated 2 November 2018. 





Criteria for score 4 have been met. 


Evidence: 

-Letter offering report investigation on the National Financial statement 2017 
to the legislature dated, 2 November 2018. 

-Report was published on 9 November 2018 - Evidence: screenshot publish 
reports on: website www.rekenkamer.aw 

-Letter offering report investigation on the National Financial statement 2018 
to the legislature, dated 7 august 2020. 

-Report was published 10 august 2020 - Evidence: screenshot publish reports 


on: website www.rekenkamer.aw 





All criteria have not been met. 


SAI Aruba does not have a follow-up system to address the observations and 
recommendations in the compliance audit reports, but take them into account 
in the next years audit. This is, however, not in line with the SAI PMF criteria 
for this dimension. 





4.4 Domain D: Financial Management, Assets and Support 


Services 


Domain D examines whether the SAI is managing its own operations economically, 


efficiently and effectively and complies with applicable rules and regulations. Domain D 


comprises a single indicator. 


Domain D: Financial Management, Assets and Support 


Services 


Indicator 


Name 





Dimensions Overall 
FY ole) a=) 


ii iii 
SAI-21 Financial Management, Assets and Support 3 2 3 3 
Services 
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4.4.1 SAI-21: Financial Management, Assets and Support Services - Score 3 

SAI-21 examines the SAI’s internal system of financial management and control, as well 
as its policies and practices regarding the support services and resources it requires. Those 
include Information Technology (IT), assets and infrastructure, as well as administrative 


support. 


This indicator has three dimensions: 


(i) Financial Management. 
(ii) Planning and Effective Use of Assets and Infrastructure. 
(iii) Administrative Support Services. 


The assessment of SAI-21 was based on the following (evidence) documentation: 


e Protocol Secretary-General responsible for entering into obligations. 

° Handbook Financial Administration. 

° Authorization list of the Department of Finance 2019. 

e Annual report 2017, 2018 and 2019. 

e National Ordinance Court of Audit Aruba (AB 1998 no. GT 20). 

e Compliance Regulation 1989 (AB 1989 no. 72). 

e Arrangement for other financial administration (ROFA) (AB 1991 115). 

e Arrangement budgetary and financial administration AB 1990 no. 98.External IT support: 
Service Level Agreement. 


° Organizational handbook: organization description, structure and job description. 


Dimension (i): Financial Management 


In this dimension, we assessed if the SAI has the adequate financial resources to function 
effectively. Management of financial resources must follow a system characterized by 
transparency and accountability, including internal control and documentation of costs. To 
ensure effective management of its financial resources, the SAI has clearly assigned 
responsibilities for all aspects of its financial management activities. SAI Aruba has written 
protocols that state that the Secretary-General is authorized to enter into obligations and 
generate purchase orders. The SAI also has a Financial Administration Handbook that 
clearly defines who is responsible for all major financial management activities. This 
handbook was made to optimize the financial administration's internal processes and to 
ensure that the work is performed efficiently and effectively. The handbook is digitally 
available to all employees of the SAI. 


The SAI operates a system of delegation of authority to commit, incur, and approve 
expenditures on behalf of the SAI, except to close a long contract or an employment 
agreement. For the contracts, the authority is in the Minister of General Affairs’ hands. 
For the approval for expenditures, the Department of Finance sends a list each year to 
include authorized persons to incur and approve expenditures. SAI Aruba is not entitled 
to process payments on expenditures. The Department of Finance conducts all payments. 
For the part of the SAI’s payroll, it is registered and administrated by the Human Resource 


Department and the Department of Finance. The SAI however, maintains a record of the 
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personnel costs in its own administration. Other staff costs such as education, travel, and 
work-related expenses are administrated and approved by the SAI and processed by the 


Department of Finance. 


According to the SAI PMF manual criteria, the SAI should have a functioning management 
information system, including financial and performance information. SAI Aruba has a 
management information system (ERP), but it is not yet fully operational. Currently, the 
administration of the SAI is being done with Microsoft Excel spreadsheets. At the end of 
each month, the financial figures are compared with the monthly overview from the 
Department of Finance administration, which is sent to the SAI. The SAI follows and 
complies with the budgeting timetable, processes, and procedures specified by the Ministry 
of Finance. The SAI also applies the government regulations as a procedure for the 
budgeting process. By law, the SAI must submit its budget before September 1 of the 
previous budget year to Parliament. The costs and investment estimates are required to 


stay within the Minister of General Affairs' margins. 


ISSAI 20 states that the SAI’s financial statement should be made public and subjected 
to external independent audit or Parliamentary review. SAI Aruba does not prepare a 
financial statement, since it is part of the financial statement of Country Aruba, but 
submits an annual report that includes the SAI’s financial accountability. The SAI's annual 
reports are made public and are subject to an external independent auditor for reporting 
of the budget realization and if the expenditure comply with the existing regulations. In 
the annual report, the SAI provides information on the budget execution. Financial 


accountability is included in the annual report with the review of an external accountant. 


Dimension (ii): Planning and effective use of assets and infrastructure 


In this dimension, we assessed if the SAI’s assets are well managed. The SAI should 
develop short and long-term asset management plans based on current, and future 
anticipated needs to manage the assets. Also, the SAI should regularly review asset 
utilization to ensure assets are used effectively and report to the Legislature, where it 


considers its current assets and infrastructure to be insufficient. 


According to the criteria, the SAI should develop a long-term strategy or plan for its 
physical infrastructure needs and a shorter-term plan for its IT needs, based on current 
and anticipated future staffing levels. SAI Aruba does not currently have a long-term plan 
for its physical infrastructure needs. The SAI resides currently in a building that meets the 


current staff needs and the SAI's anticipated future staffing. 


The SAI has not developed a short-term plan nor a strategy plan for its IT needs. In the 
field of IT, the SAI receives support from an IT centralized government department. The 
IT infrastructure is replaced every three to five years, and the needs of the current and 
future staff are considered. The SAI has not reviewed its IT infrastructure's adequacy and 
has not conducted an IT self-assessment. Every year with the budget draft, IT's needs are 


evaluated, although this is not in the form of a complete assessment. 
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The SAI should also have secured access to appropriate archiving facilities, which enable 
all relevant records to be stored securely over several years and accessed when needed. 
SAI Aruba does not have secured access to the physical archiving facilities, in the form of 


restriction to unauthorized personnel. 


The physical archive is kept for several years, which the SAI predetermines. The SAI 
archive also is kept digitally and is to some extend more secure than the physical, since 
it is only accessible by the SAI staff. 


According to this criteria the SAI should reports any inadequacies relating to its assets 
and infrastructure in its annual report or similar when relevant matters arise. SAI Aruba 
does report any inadequacies relating to its assets, infrastructure, and any further insights 
into the SAI's financial accountability in its annual report. 


Dimension (iii): Administrative support services 


In this dimension, we assessed if the SAI has appropriate administrative support to 
function and maintain its assets and infrastructure effectively. 

According to the criteria, the responsibility for IT support should be clearly assigned, and 
the staff tasked with this have the appropriate skillset and resources to do the job. Since 
SAI Aruba is a small organization, the SAI does not have its own IT department. Two staff 
members of the audit department support the SAI with all basic IT matters. They are the 
contact persons for the government IT department. It is not their main responsibility, but 
they have the expertise and resources to do the job. The government IT department is 
responsible for the exploitation of the information and communication infrastructure. This 
department is also responsible for the day-to-day management of the networks and 


computer systems in use. 


The responsibility for file management and archiving should also be clearly assigned and 
the staff tasked with this have the appropriate skills set and resources to do the job. SAI 
Aruba has clearly assigned the responsibilities for file management and archiving and they 
were included in the organizational handbook. The SAI has two staff members assigned 
to carry out this work. The SAI’s archive is since January 2021 registered in a document 


registration system that was recently renewed and re-installed. 


According to the SAI PMF criteria, the responsibility for the management of all major 
categories of assets and infrastructure should also be clearly assigned and the staff tasked 
with this should have the appropriate skillset and resources to do the job. The SAI has an 
open vacancy for an operations manager that in practice will be responsible for the 
management of all assets and these responsibilities are clearly assigned in the 
organizational handbook. 


Assessment Findings and Observations 
Dimension Findings 


Criteria a, b, c, d, e, g, and h, have been met. 


(i) Financial Criteria f, i, and j have not been met. 


Management Criteria k is not applicable. 
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Dimension Findings ea 


The SAI operates within a well-defined structure in relation to financial 
management, assets, and support services. The responsibilities for all aspect of 
its financial management are written down in the Handbook Financial 
Administration and are digitally available for all staff members. 


The SAI follows the legal regulations as a procedure for the budgeting process. 
The ones responsible for the setup of the budget have the appropriate skill set, 
experience, and resources to do the job. In the annual report the financial 
accountability is included with the review of an external accountant. 





Criteria d have been met. 

(ii) Planning and Criteria a, c, and e have not been met. 

effective use of Criteria b is not applicable. 

Assets and 

Infrastructure SAI Aruba has not develop a long-term plan for its physical infrastructure nor a 
short-term plan for its IT needs. In the fields of IT the SAI receives support from 
the Department of Information Provision and Automation. About the 
infrastructure the SAI is currently in a building that meets the needs based on 
the current and anticipated future staffing of the SAI. 

The SAI reports any inadequacies relating to its assets, infrastructure, and any 
further insights into the SAI’s financial accountability in the annual report. 





Criteria a, b, and c have been met. 


GDeGhyiieiaeia. | Criteria d have not been met. 


Support Services 


SAI Aruba does not have its own IT Department. Two staff members of the audit 
department voluntarily support the SAI with all basic IT matters. They are in 
charge of the functional application management. 

Responsibility for all organizational matter is assigned to the Secretary-General. 
The SAI has also clearly assigned the responsibilities for file management and 


archiving. 














4.5 Domain E: Human Resources and Training 


Domain E assesses the way in which the SAI manages and develops its human resources 
insofar as it has the power to do so. Domain E comprises two indicators. 


Domain E: Human Resources and Training | Dimensions Overall 


Indicator Name i ii score 






Human Resource Management 2 2 Ps 





SAI-23 Professional Development and Training 0 0 0) 























4.5.1 SAI-22: Human Resource Management - Score 2 


This indicator assesses elements of the SAI’s resource management. The assessment 
builds on the requirements of ISSAI 40, which stipulates that the SAI’s human resource 
policies and procedures should include, amongst other things: recruitment, professional 


development, performance evaluation, and promotion. 
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It assesses four dimensions: 


(i) Human Resources Function 

(ii) Human Resources Strategy 

(iii) Human Resources Recruitment 

(iv) Remuneration, Promotion and Staff Welfare 


Evidence used for this dimension were: 


e Strategic Policy plan 2019-2022. 

e Organizational Handbook: organization description, structure and job description (2012). 
e Annual plan SAI Aruba 2019. 

e Letter regarding recruitment of personnel. 

e Law for legal position art. 13 (LMA%8). 


Dimension (i): Human Resources Function 


This dimension relates to the SAI’s responsibilities on human resource management. SAI 
Aruba does not have a Human Resource (HR) department. However, the Secretary -General 
is responsible for the human resource management of the SAI. 

Aruba has a centralized HR government department for all public entities and this 
department is responsible for setting all public sector staff policies. The HR government 
department provides guidance to the SAI and consultation on all HR matters. SAI Aruba 
has a strategic policy plan that includes aspects of an HR strategy. The Secretary -General 
is responsible for the realization of the strategy. The SAI also has an_ internal 
organizational handbook that describes all the staff’s skills and knowledge to conduct their 
work. This handbook was compiled together with the HR government department and was 
approved by the Head of SAI and the Council of Ministers. However, the handbook has not 


been translated into a competency framework, as required by the SAI PMF criteria. 


The team did not find evidence that the SAI maintained a structured performance 
evaluation appraisal system, which is an SAI PMF criteria. In the past years the SAI did 
not evaluate their employees for their performance, nor did appraisal interviews occur. In 
practice, when the employees are eligible to a promotion by law, they can request a 
performance evaluation. 

Recently an external consultancy firm developed a document that include the HR- 
instruments for SAI Aruba. This document discusses, amongst others, the conditions for 
an appraisal and remuneration system. However, since the SAI staff conditions for 
remuneration and appraisal are covered in the government legislation, this documentation 
cannot be applicable to the current staff, being civil servants. The documentation is in 
anticipation of the new legislation that the SAI is in the process to introduce. During this 
assessment, this HR-document was not yet established by the Head of the SAI. 


In 2019, on the Head of SAI's initiative, the employees took part in an individual Personal 
Development plan for the years 2019-2024. This plan contains a schedule for the staff's 





38 LMA stands for National Ordinance civil service 
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professional development goals and opportunities. It is essential to mention that the plan 
is based on the needs of the staff, and it does not match the needs of the organization. 
This plan is still a draft, and the realization of the plan has not taken place yet. 


The SAI also maintains personnel files that include e.g., a signed code of ethics, obtained 
certificates, performance reports, correspondence promotion, nomination for employment, 
etc. The SAI, however, does not have a continuing professional development report for all 


their staff, since this is still in progress. 


Dimension (ii): Human Resource Strategy 


One of the SAI PMF criteria states that the SAI’s human resource strategy needs to address 
the following aspects: recruitment, performance management, training and development, 
retention, and staff welfare. Some of these aspects are addressed in the SAI's Strategic 
Policy plan 2019-2022. 


To shape the ambitions and realize its vision and mission of the HR strategy addressed in 
the strategic policy plan, the SAI formulated results areas. The results areas have not 
been formulated in to concrete action plans. 

The HR strategy was communicated to all staff thru the strategic policy plan. The intention 
is that the strategic policy plan is reviewed and updated every four years. 

The strategic policy plan does not cover all elements of an HR strategy. The plan indicates 
that the SAI strives for a quantitative and qualitatively optimal workforce, with all its 
employees being well-trained professionals. The plan further describes that this objective 
will be realized by focusing on the permanent development of the required competencies 
(training policy) and the employees' ambitions (Personal Development plan). This HR plan 
is, however, not been further developed into concrete indicators, baseline, or targets. Also 
the Strategic Policy plan 2019-2022 does not take into considerations the number and 
type of staff required for the strategic planning period. 

The assessment also indicates that not all of the achievement targets of the HR strategy 
are monitored annually, as required by one of the criteria in this dimension. The Head of 
SAI and the Secretary-General does, however, discuss and monitor the recruitment target 


that was set. 


Dimension (iii): Human Resources Recruitment 

This dimension examines whereas the SAI has a transparent recruitment process, driven 
by an assessment of its needs. 

The SAI has no written procedures in place for their recruitment process. The SAI had an 
recruitment plan, that was included in the Annual plan 2019. It is not known if the 
recruitment plan will still be considered for the current period. The recruitment plan was 
based on needs, vacancies, competencies, and skills level of the appropriate candidates. 
The competencies, skills levels, and the minimum qualifications required for recruited staff 
are described in the organizational handbook. For the SAI’s staff recruitment, a selection 
committee advises the Head of SAI on suitable candidates for each of the open vacancies. 
Each year the SAI includes in their annual budget the open vacancies that they want to 
fill during that year. 
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The SAI has been struggling with staff shortage for many years, and the staff turnover 


has been minimal. 


Currently, all vacancies are announced on the SAI’s website. Vacancies are also published 
in various newspapers on the island. The advertisement published in the newspaper does 
not include the description of the skills and experiences needed. However, a reference is 
made to the SAI’s website for further information about the job description. 

The SAI does not have procedures in place regarding the quality of the deliverables, when 
recruiting new personnel. However, recent recruitments were done with the help of an 
external consultancy firm for the selection and assessment, to ensure that suitable 
candidates were chosen for the vacant positions. Also, the Prime Minister, who decides on 
the formal appointment, inquires the HR department of the government for advice prior 
to deciding on and the appointment of the candidate. The advice that is given by the 
centralized HR department is part of the process during the appointment of personnel and 


a policy of the government of Aruba. 


Dimension (iv): Remuneration, Promotion and Staff Welfare 

This dimension covers the remuneration, promotion, and staff welfare in order to keep the 
staff motivated. The SAI does not have an internal procedure or system in place for 
promoting the personnel and nor does the SAI have a staff welfare policy. Since the SAI 
is still part of the government, the procedure to promote the personnel is laid down by 
law. The SAI uses also, the government established central procedure for promotion for 
all civil servant. When promoting, personnel has conditional rights by law for a promotion, 
it is based on assessing performance and potential. The SAI has no established routines 
to ensure performance appraisals. However, in the past the Head of SAI decided to 
appraise employees every year. When personnel has conditional rights by law for a next 
pay-grade, the personnel gets a performance appraisal. The SAI can also request a specific 
bonus for personnel, given the circumstance presented in the execution of an 


extraordinary performance. 


Assessment Findings and Observations 
Dimension Findings 


Criteria a, b, d, and g have been met. 


(i) Human Criteria c, e, and f have not been met. 


Resource Function 


The SAI does not have its own HR-department. However, the Secretary-General 
is responsible for the SAI's human resource management and provides guidance 
and consultation on human resource matters. The government’s HR department 
is centralized for all public entities and is responsible for setting all public sector 


staff policies. 





Criteria a, f, and g have been met. 

(ii) Human Criteria b, c, d, and e have not been met. 

Resources 

Strategy Not all the aspects of HR are reflected in the SAI's Strategic Policy plan 2019- 
2022. The strategy is communicated to all staff thru the strategic policy plan. 
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Dimension Findings 


The intention is that the strategic policy plan is reviewed and updated every four 
years. 

Not all of the achievement targets of the HR strategy are monitored annually. 
The Head of SAI and the Secretary-General only monitor the recruitment target 
during the board meetings. 





Criteria d and f have been met. 

(iii) Human Criteria a, b, and c, e and g have not been met. 

Resources 

Recruitment The recruitment of the SAI personnel is done by a selection committee, who in 
turn gives advice to the Head of SAI on the suitable candidate. All vacancy 
announcements are made public. The SAI has no written procedures in place for 


recruitment. 





Criteria d, e, g, and h have been met. 


GO) Sates, | Criteria a, b, c, and f have not been met. 


Promotion and 
Staff Welfare The centralized HR department has procedures in place for promoting the 


personnel. The SAI does not have a staff welfare policy. Since the SAI is still 
part of the government, the procedure to promote the personnel is laid down by 


law. There is also no established routines to ensure performance appraisals. 














4.5.2 SAI-23: Professional Development and Training - Score 0 


This indicator assesses how the SAI as an organization is able to promote and ensure 
professional development to improve and maintain the competency of its staff. It is linked 
to ISSAI 12. This ISSAI states that SAI should promote continuing professional 
development that contributes to individual, team and organizational excellence. 


It assesses four dimensions: 

(i) Plans and Processes for Professional Development and Training 
(ii) Financial Audit Professional Development and Training 

(iii) Performance Audit Professional Development and Training 

(iv) Compliance Audit Professional Development and Training 


The assessment of SAI-23 was mainly based on the SAI’s Personal Development plan, 
even though it has not yet been finalized and fully implemented. Since SAI Aruba is a 
small SAI, it is not feasible to ensure specialized professional development for all its audit 
staff in all audit types. 


Dimension (i): Plans and Processes for Professional Development Training 

The SAI should establish and implement plans and processes for professional development 
and training to ensure its staff have the competency and skills to perform their roles and 
enable the SAI to achieve its objectives. The SAI has not yet developed a plan for 
professional development and training. The personnel is currently working on their 
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Personal Development plan. The SAI intends to develop a total professional development 
and training plan after every individual Personal Development plan is completed. 

The SAI's strategic policy plan addresses the Head of SAI's vision to invest in the further 
professionalism of the SAI’s staff. The SAI has also not yet address how it plans to develop 
each type of audit and align it to a staff development plan. 

The organizational handbook specifies which background education is needed for the 
different functions within the SAI. The SAI has not yet developed a system to monitor and 


evaluate the results of the professional development and training. 


Dimension (ii): Financial Audit Professional Development and Training 

The SAI should establish and implement professional development and training for the 
financial audit type. Since the SAI does not conduct a financial audit, the SAI has not 
developed competency requirements for this type of audit. However, recently some 
auditors started with an education to obtain a certified public accountants (CPA) degree, 
that will further contribute to the staff development in the financial audit field. 

The SAI PMF criteria states that the SAI should assign the responsibility for professional 
development in financial audit to a person with sufficient and appropriate experience and 
authority in the SAI. For SAI Aruba the Secretary-General is assigned with this 
responsibility, and the project leaders carry the responsibility in identifying the needs of 


the team members. 


Dimension (iii): Performance Audit Professional Development and Training 

The SAI should also establish and implement a professional development and training for 
performance audits. As it is explained in dimension (i), the SAI has not yet developed a 
Professional Development plan and training for any specific audit type. In the past, the 
SAI has granted the staff the opportunity to participate in performance audit programs 
organized by other SAI’s. In recent and on-going audit work, the SAI staff has also applied 
many performance audit principles based on their experience from working together with 
SAI Netherlands and from the available ISSAI literature on performance audit. 


Dimension (iv): Compliance Audit Professional Development and Training 

This dimension examined whereas the SAI established and implemented a professional 
development and training for compliance audits. The SAI has not developed a Professional 
Development plan and training for compliance audit. The auditors that are currently 
conducting compliance audits included the compliance audit principles in their work, based 
on the available material obtained by SAI Netherlands and to the extent of their 


experience. 


Assessment Findings and Observations 


Dimension Findings 












All criteria were not met. 
(i) Plans and The SAI does not have a formal professional development and training plan in 
Processes for place. A professional development and training plan will be developed upon 


Professional completion of the individuals personal development plans. 
Development and 








Training 
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Dimension Findings ea 


All criteria were not met. 


DEES Tt) The SAI has not yet developed a plan for professional development and training 
Professional for financial audit. However, steps are being made in professional development 
Development and and training in financial audit. Some auditors have started with an education to 
Training obtain a CPA degree. 





All criteria were not met. 


(iii) Performance The SAI has not yet developed a plan for professional development and training 


ONES BOSS) for performance audit. 
Development and 


Training 





All criteria were not met. 


(iv) Compliance The SAI has not yet developed a plan for professional development and training 
ONT S DEISSSI ) tor compliance audit. 


Development and 








Training 








4.6 Domain F: Communication and Stakeholder Management 


Domain F looks at the extent to which the SAI has established effective communications 
with its key stakeholders. Domain F comprises two indicators. 


Domain F: Communication and Stakeholder Management Dimensions 


Indicator Name i ii iii 






Communication with the Legislature, Executive 
and Judiciary 
SAI-25 Communication with the Media, Citizens and 2 1 
Civil Society Organizations 


























4.6.1 SAI-24: Communication with the Legislature, Executive and Judiciary - 
Score 1 


SAI-24 seeks information on the existence of a current strategy to regulate 
communications at levels for the SAI. It also explores the status of communication 
channels and their effectiveness with a range of other interested parties. The outputs from 
a SAI are reports. The content of these needs to be made available in a coherent way to 
those who will be expected to have an interest or are mandated to act upon the content 
of these reports. This indicator has four-dimensions: 


(i) Communications Strategy. 

(ii) Good Practice Regarding Communication with the Legislature. 

(iii) Good Practice Regarding Communication with the Executive. 

(iv) Good Practice Regarding Communication with the Judiciary and/or Prosecuting and 


Investigating Agencies. 
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The assessment of SAI-24 was mainly based on the National Ordinance Court of Audit 
Aruba, the SAI’s strategic policy plan, and invitation letter for a meeting with Parliament 
of Aruba. 


Dimension (i): Communications Strategy 


In this dimension, we assessed if the SAI has a communications strategy aligned with the 
objectives established in the SAI’s strategic policy plan. The purpose of a communications 
strategy may include support from decision-makers, media, and citizens for the SAI’s role. 
Also it may clarify the SAI’s role if there is potential for confusion among other institutions. 
SAI Aruba did not establish a communication strategy. However, the SAI's strategic policy 
plan describes how the SAI intents to strengthen its communication with Parliament, some 
stakeholders and the Aruban community. The strategic policy plan also mentions all 


external parties to whom the SAI intents to communicate with. 


The SAI should identify the key messages, appropriate tools, and approaches that the SAI 
wants to communicate. SAI Aruba has not yet identified the key messages that they want 
to communicate. In practice, when publishing a report, the key messages that the SAI 
communicates are a summary of the audit's objectives, findings, and conclusions. The SAI 
has also not identified the appropriate tools and approaches for external communication 
and nor does it has procedures in place when approaching external communication 
channels. In practice, the SAI uses different type of media, online channels such as online 


news portals, LinkedIn, and its website. 


The SAI does not periodically assess, whereas the stakeholders believe the SAI’s 
communication is effective. In 2018 for the development of the strategic policy plan, the 
SAI conducted a SWOT-dialogue with only Parliament as their key stakeholder. The SAI 
gathered feedback on the functioning and areas they could improve, which were included 


in the strategic policy plan. 


Dimension (ii): Good Practice Regarding Communication with the Legislature 

This dimension assessed the communication of the SAI with the legislature (Parliament). 
The Parliament is one of the most important stakeholders of the SAI, as it also plays a 
role in holding the executive accountable for the use of public funds. The Parliament must 
perceive the SAI as a relevant and valuable partner in overseeing the actions and spending 


decisions of the executive. 


According to the National Ordinance Court of Audit Aruba, the SAI must report its findings 


annually to the Governor and Parliament. 


The SAI does not have any policies or procedures in place regarding its communications 
with the legislature, nor is there a systematic dialogue structure with Parliament. In 
practice, the Head of SAI and the Secretary-General communicates with Parliament. The 
Head of SAI and Parliament's chairman agreed during an introduction meeting to 
communicate every three months with each other. In 2017 when the new Parliament was 
formed, the SAI gave a presentation to inform the new Parliament members on the SAI's 


role and mandate. 
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The SAI has not yet developed professional relationships with relevant legislative oversight 
committees to help them understand the audit reports and conclusions better and take 
the appropriate actions, as stated by ISSAI 12. According to the strategic policy plan, the 
SAI plans to strengthen the relationship with administrative stakeholders through formal 


and informal meetings. However, these intentions have not yet been concretized. 


One of the criteria in this dimension examines whereas the SAI provides the legislature 
with timely access to information related to the SAI’s work. The mandate of the SAI does 
not state that the SAI must provide information to Parliament. However, upon request by 
Parliament, the SAI can submit information about the work or answer any questions from 


Parliament on the SAI’s audit work. 


According to the criteria, where appropriate, the SAI should also provide the legislature 
with its professional knowledge in the form of expert opinions, including comments on 
draft laws and other financial regulations. For the years under review, SAI Aruba did 
provide the legislature with its professional knowledge in the form of expert opinions. In 
the past a committee on the democratic system was established to adapt the current 
legislation. Part of that legislation included changes in the SAI regulatory position. SAI 


Aruba provided its opinion and comments on these draft laws. 


Dimension (iii): Good Practice Regarding Communication with the Executive 


This dimension assessed the SAI's communication with the executive. Such strategic 
communication may lay the foundations for the SAI's work to be relevant to the auditees. 
In the National Ordinance Court of Audit Aruba, it is arranged that the Head of SAI shall 
not have any undesirable relations for the proper performance of their duties or the 


maintenance of their impartiality and independence of their confidence in it. 


The SAI should provide generic information to auditees on what to expect during an audit. 
The SAI does not have any communication protocols that cover all the elements the SAI 
should communicate with the audited entities. The SAI does not have periodic meeting 
with the executive to discuss common findings, based on the audit reports nor does it seek 


feedback from the audited entities about the quality and relevance of its reports. 


Dimension (iv): Good Practice Regarding Communication with the Judiciary 
and/or Prosecuting and Investigating Agencies. 

This dimension assessed if the SAI's working relations with the Judiciary and/or 
prosecuting and investigating agencies are established and maintained. 

SAI Aruba does not have any policies and procedures for communicating with the Judiciary 
and/or prosecuting and investigating agencies regarding audit findings relevant to those 
agencies. The SAI also does not carry out awareness-raising activities with the Judiciary 
and/or prosecuting and investigating agencies on the SAI's role, mandate, and work. 

In the years under review, the SAI has not communicated with the Judiciary and/or 
prosecuting and investigations agencies about the SAI's role in investigations and legal 


proceedings that could be initiated based on the SAI's audit findings. 
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The SAI has no jurisdictional function to set policies and procedures for audit 
documentation to ensure compliance with applicable evidence rules. In the past, the SAI 
had an arrangement with the Court of Justice in Aruba. All the verdicts regarding the court 
cases that have financial implications for Aruba's country were sent to the SAI. Since 


2017, SAI Aruba no longer receives these verdicts. 


Assessment Findings and Observations 


Dimension 


All criteria have not been met. 


(i) Communications 


Strategy 


(ii) Good Practices 
Regarding Communication 


with the Legislature 


(iii) Good Practices 
Regarding Communication 


with the Executive 


Criteria a, b, c, and d have not been met. 


(iv) Good Practices 


Regarding Communication 


with the Judiciary and/or 


Prosecuting and 


Investigating Agencies 





4.6.2 SAI-25: Communication with the Media, 


Findings 


SAI Aruba has not established any communication strategy nor policy to 
communicate the value and benefits that the SAI has to the society in the 


period under review. 





Criteria a, d, f, and g have been met. 
Criteria b, c, e, and h have not been met. 


According to the National Ordinance Court of Audit Aruba, the SAI has an 
obligation to report annually its findings to the Governor and Parliament. 
However, the SAI does not have any policies or procedures in place 
regarding its communications with the legislature. In practice, there is 
some kind of communication between the Head of SAI and the 
Parliament’s chairman. Also the Secretary-General and the Registrar 
communicate occasionally. The SAI did not provided the legislature with 
its professional knowledge in the form of expert opinions. 





Criteria a has been met. 
Criteria b, c, and d have not been met. 


In the National Ordinance Court of Audit Aruba it is clearly set that the 
Head of SAI shall not have any relations, which are undesirable for the 
proper performance of its duties or for the maintenance of their 
impartiality and independence of their confidence in it. The SAI does not 
have any communication protocols that cover all elements the SAI should 
communicate with the audited entities. 





Criteria e is not applicable. 


The SAI has no established policies and procedures for how to 
communicate with the Judiciary and/or prosecuting and investigating 


agencies regarding audit findings relevant to those agencies. 








Citizens and Civil Society 


Organizations - Score 1 


This indicator assesses the extent to which the SAI reaches out to the wider public through 


the media and civil society to inform about its role and the results of its work. 


It has two dimensions: 


(i) Good Practices Regarding Communication with the Media. 
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(ii) Good Practices Regarding Communications with the Citizens and Civil Society 
Organizations. 


The assessment of SAI-25 was mainly based on the following sources: 

e Press releases for the reports on the investigation on the National Financial statement 2017. 
e The investigation on the National Financial statement 2018. 

° The report on Public Private Partnership. 

e E-mails sent to department of information to disseminate the press release. 

e Email invitation for presentation of report Public Private Partnership. 

° The summary included in the published reports. 


° The SAI’s website: www.rekenkamer.aw. 


Dimension (i): Good Practices regarding Communication with the Media 

For this dimension, the team assessed whereas the SAI maintains an effective relationship 
with media organizations to maximize public exposure of important audit findings. 

For the period under review, only on one audit report, a press conference was given for 
the publication, which was the performance audit report on Public Private Partnership. All 
other reports that the SAI published had a press release through newspapers and online 
news. 

SAI Aruba uses the centralized government department of communication to distribute 
the audit reports to all (online) media and newspapers. The SAI has not established a 
system to monitor the media's coverage and topics addressed by the SAI's audits. All 


topics that are covered by the media are, however, kept internally in the audit files. 


The SAI has not established procedures for handling requests from the media and has not 
assigned a media contact point. In practice, the Head of SAI and the Secretary-General 
are responsible for handling requests from the media. Also, the Head of the SAI, 
particularly the chairman, is authorized to communicate with the media on behalf of the 
SAI. 


Dimension (ii): Good Practices regarding Communication with Citizens and Civil 
Society Organizations 

For this dimension, the team assessed if the SAI reaches out to the society and informs 
the public about its role, work, results, and contribution to enhancing accountability in the 
public sector. 

SAI Aruba has made its mandate available on the SAI's website, so the citizens and civil 
society organizations get acquainted with the SAI's role and responsibilities. The SAI also 
publishes all its audit reports that include a summary. The summaries are published to 
make it easier for citizens to understand the main audit findings. The summaries are 
written in both the local language (Papiamento) and the Dutch language. The audit report 


is written in the Dutch language. 
The reports are made publicly available to all citizens, and are available on the SAI's 


website. Other than the public access to the reports and information available on the 


website, the SAI does not hold separate activities to encourage access to information on 
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public sector audits and information beyond the SAI’s audit reports. The SAI has not 
established contact with relevant civil society organizations to encourage them to read the 
audit reports. 


According to the criteria, the SAI should make adequate use of online media, according to 
the country’s culture. When publishing the audit reports, SAI Aruba encourages citizens 
to download their reports from the SAI's website and strives to keep their website as user- 
friendly as possible. Besides the SAI's website, the SAI also has a LinkedIn account, where 
they promote and publish all their audit work, annual reports and other important events. 
The SAI has not gathered feedback from civil society organizations or public members on 
the accessibility of its reports for further improvement. 

This dimension also examined whereas the SAI contributed to debates on the improvement 
of the public sector, without compromising its independence. In the previous years, SAI 
Aruba has not participated in a debate to improve the public sector. In the past, some of 
the SAI staff members have been part of workgroups or committees that focus on 
particular topics regarding Aruba's financial legislature. The SAI staff members 
participated in the form of audience or listeners, where they gave their recommendations, 
but did not advise on certain areas to preserve their independence. 


Assessment Findings and Observations 

Dimension Findings 
Criteria b, c, and e have been met. 
(i) Good Practices regarding Criteria a, d, and f have not been met. 
Communication with the 
Media SAI Aruba issued a press release for all reports under review, including 
the performance audit reports. For the reports under review the SAI 
approached the media through the governments communication 
department to disseminate the audit report to all (online) media and 
newspapers. For all reports, SAI Aruba issued a press release. The Head 
of SAI, in particular the chairman, is the one responsible to communicate 
externally with the media on behalf of the SAI. 


The SAI has not established a system to monitor the media’s coverage, 
nor does the SAI have a procedure for handling requests from the media. 


AY of o) =) 





Criteria a, b, and f have been met. 
(Ci) (cterere) evel sfelts ets veitiye) | Criteria c, d, e, g, and h have not been met. 
Communication with Citizens 


d Civil Soci 
anacivil Society The SAI uses its website to communicate with citizens and other 


Organizations 


stakeholder by publishing all its audit reports and information. Other 
than public access to the reports and information available on the 
website, the SAI does not hold separate activities to encourage to access 
information on public sector audits and information beyond the SAI audit 
reports. The SAI has not established contact with relevant civil society 
organizations and encouraged them to read the audit reports. The SAI 
also has not contributed to a debate for the improvement of the public 
sector. 











106 





SAI Performance report of SAI Aruba 


5 SAI Capacity Development Process 


5.1 Description of the SAI’s legal and institutional framework, 


organizational structure and resources 


In 2017 SAI Aruba approached a government advisory foundation (SOAB?%) located in 
Curacao to help the SAI resolve some organizational issues the SAI was facing. The 
organizational issues were among others, about the existing gaps and uncertainty 
regarding the tasks, responsibilities, and accountability between the Head of SAI and the 
Secretary-General, project leaders, and the auditors. 

SOAB was also approached to support the SAI in developing a new National Ordinance, an 
HRM handbook, and a new Strategic Policy plan 2019-2022 combined with an annual plan 
for 2019. 


The Strategic Policy plan 2019-2022 and the annual plan for 2019, were completed and 
formally approved by the Head of SAI. 


SOAB, in cooperation with the acting chairman of the Head of SAI also made a draft for a 
new National Ordinance for the SAI. The process to formally establish this new National 
Ordinance will, however, take more time. The Directorate of Legislation and Legal Affairs 
need to revise the new National Ordinance before it can be submitted to Parliament for 
formal approval. The new National Ordinance drafted by the SAI provides more clarity on 
the SAI’s independence, however, the principles and scope of the SAI’s work are still not 
well defined as it is addressed by the ISSAIs. The new National Ordinance also gives the 


SAI more freedom to attract and retain highly qualified personnel. 


Internally, the SAI developed and implemented an integrity policy plan and a code of 
ethics. These two documents were recently approved by the Head of SAI. 


SAI Aruba has set its ambition in the Strategic Policy plan 2019-2022 to publish more 
reports that meet higher quality requirements. According to the strategic policy plan this 
will require a well-established institute with clear powers and responsibilities, staffed by 
professional and well-trained personnel. To guarantee and improve the quality of the 


investigations, the SAI will establish standards for their reports. 


The strategic policy plan also states that it is important that employees continue to develop 
themselves through education and training. The strategic policy plan has not been 
crystallized in concrete actions to guarantee reaching these goals. There are, however, 


actions being taken. For example, the SAI personnel carried out in 2018, with the 





3° SOAB stands for Stichting Overheidsaccountantsbureau (government's auditor and advisory partner) 
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assistance of an external consultant, a self-assessment for developing a Personal 
Development plan. This plan has not been matched yet with the goals and expectations of 
the SAI, and this process is not finished yet. 


The Head of SAI and the Secretary-General indicates that the development of an integrity 
policy plan, a code of ethics, and participation in this performance measurement 
assessment is a step towards a more professional organization that will lead to 
documenting the necessary procedures and implementing the ISSAI standards. Below is a 


recapitalization of the recent and ongoing reforms. 


Recent Reforms: 


e Development of a Strategic Policy plan 2019-2022 (Date approval: 11 July 2019). 

e Development of an Integrity Policy plan (Date approval: 1 July 2020). 

e Development of a Code of Ethics (Date Approval: 1 July 2020). 

e Development of an Annual plan 2019 (Date approval: 4 June 2019). 

e Implementation of an ERP system for communication and research management. 

e Implementation of an ERP system for financial administration. 

e Implementation of e new documentation management system for registering all incoming 


and outgoing documents. 


Ongoing reforms: 

e Formalization of a new legislature concept, National Ordinance Court of Audit Aruba. Status: 
Under revision. 

e Formulating the tasks, responsibilities and accountability for the function of the Secretary- 
General, project leaders and the auditors. This must be reflect in the new legislature and the 


Rules of procedures of the SAI. Status: not submitted for approval. 


Development of an HRM handbook. Status: Not yet approved. 


Personal Development plan. Status: Not yet approved. 


Annual plan/Operational plan 2021-2022. Status: Under revision. 


Baseline measurement SAI Performance Management Framework 


Planning reforms: 


e Implementation of audit standards. Status: Gathering the necessary understanding and 
acquaintance with the ISSAI. 
e Take part of the Strategy Performance Measurement & Reporting initiative. 


5.2 Use of SAI Results by External providers of Financial 


Support 


SAI Aruba participates in CAROSAI regional projects and IDI global projects (delivered in 
partnership with CAROSAI). The assessment team is not aware of any use of the SAI’s 


audit reports by external providers of support to Aruba's government. 
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As mentioned throughout, SAI Aruba carries out investigations mainly for Parliament and 
all citizens of Aruba. SAI Aruba receives public funds to carry out its tasks. The SAI does 


not receive financial supports from external providers. 
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Annex 1: Performance Indicator Reforms 


Overall 














Indicator Indicator Name (iii) (iv) 


Yolo a=) 





Domain A SAI Independence and Legal Framework 
SAI-1 Independence of the SAI 
SAI-2 Mandate of the SAI 


Domain B Internal Governance and Ethics 


































SAI-3 Strategic Planning Cycle 





SAI-4 Organisational Control Environment 
SYN ts) Outsourced Audits 








SAI-6 Leadership and Internal Communication 
SAI-7 Overall Audit Planning 1 2 











Domain C Audit Quality and Reporting 
Sy NTs} Audit Coverage 0 2 0 N/A 
Sy Wiese) Financial Audit Standards and Quality 0 0 


Management 











Financial Audit Process 





Financial Audit Results 





Performance Audit Standards and Quality 





Management 





Performance Audit Process 





Performance Audit Results 





Compliance Audit Standards and Quality 











Management 
SAI-16 Compliance Audit Process 1 0 i 
"SAT=17 | Compliance Audit Results 2 4 0 
SAI-18 Jurisdictional Control Standards and Quality N/A N/A N/A 


Management 












N/A 
N/A 


SAI-19 Jurisdictional Control Process 
Sy NGvA0) Results of Jurisdictional Controls 


N/A 
N/A 















Services 







Domain D Financial Management, Assets, and Support 





SAI-21 Financial Management, Assets, and Support 3 2 3 


Services 





Domain E Human Resources and Training 





SAI-22 Human Resource Management 2 2 1 2 





SAI-23 Professional Development and Training 0 0 0 0 





Domain F Communication and Stakeholder Management 











SAI-24 Communication with the Legislature, Executive 0 2 L 0 
and Judiciary 
SAI-25 Communication with the Media, the Citizens 2 1 
and Civil Society Organisations 


























40 Annex 2 describes the description of each dimension that belongs to each domain. 
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Annex 2: Overview of indicators including 


dimensions 


Indicator Dimension Indicator Dimension 


oo | SAI Independence and Lega «© | Audit Quality and Reporting 
Framework SAI-8 


Independence of the SAI 


mre mc 
constitutional framework 


Financia! Audit Standards and 
Quality Management 


Performance Audit Standards 
and Quality Liaeiasieieedl 


“{ii) Implementing Perfo 
(i) Process for Selection of phy nie aan 


may ‘Assurance of _ 
Outsourced Audits 
Leadership and Internal 


Communication Performance A dit Reports. SEueeeee 
assis i) SAI Follow-up on 
Implementation of Performance 
Audit 
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Indicator Dimension Indicator Dimension 


Domain C a= | Human Resources and 


SAI-15 Compliance Audit Standards 
and Quality Management SAI-22 Human Resource Management 


tay Geeaiise vie ears Paes 


Quality C (iv) Remuneration, Promotion 
Audit and Staff Welfare 

Professional Development and 
Training 
tania 
Professional Development and 


(iii) Evaluating Audit 
Concluding 


(iii) Performance Audit 
EO! ce A Professional Development and 
(ii) Timely Publication of T esac eniassdar aan asetnacspats 
Compliance Audit Results oJ (iv) Compliance Aucit 
( p Professional Development and 
Implementation of Compliance Training 


Indicator Dimension 


a= | Communication and 
Stakeholder Management 


Communication with the 


(iii) Quality Control of Legislature, Executive and 


Jurisdictional Controls Judiciary 
Jurisdictional Control! Process 5 


(ii) Implementing Jurisdictional 
(iii) Decision-making Process 
During Jurisdictional Controls 
Results of Jurisdictional! 
Communication with the 
Fenn eeseeeeeeneeeeenensen: Judicial 
(i) Notification Communication with the Media, 
the Citizens and Civil Society 
5 oo 


-_ “ti Good Practice Regarding 
Implementation of Decisions on with the Med 


Controls 


Indicator Dimension Communication with Citizens and 


| Financial Management, Sivil 
SAI-21 Financial Management, Assets, 


Assets and Infrastructure 
(iii) Administrative Support 
Services 
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Annex 3: Sources of Information and 
Evidence to support Indicator 


Scoring 


List of Interviewees 


Acting chairman of the Court of Audit Aruba (Head of SAI): mr. Frederick Nuboer 
Secretary-General: drs. Mary Ann de Jong-Curet 
Adjunct Secretary-General: Melissa Thijsen-Rasmijn 


Research leader: Miriam de Cuba 


Documents Reviewed 


(i) Laws and regulations 
Arrangement for other financial administration (ROFA) AB 1991 115; 
Constitution of Aruba AB 1987 GT 1; 
Compliance Regulation AB 1989; 
Explanatory Memorandum of the Compliance Regulation AB 1989; 
Explanatory Memorandum of the Court of Audit Aruba AB 1998 no. GT 20; 
National Ordinance of Civil Service AB 1989 no. GT 37; 
National Ordinance of the Court of Audit Aruba AB 1998 no. GT 20; 
Rules of procedure Court of Audit Aruba AB 1998 no. 65; 
Statute of the Kingdom of the Netherlands. 


(ii) Books 
State establishment of Aruba P. Pronk; second edition Aruba 2000 


(iii) Internal documents 
Agenda and minutes of management meetings 
Access form — Department of Information Technologies 
Annual plan 2019 
Annual report 2017-2019 
Audit Proposal 
Authorization form 2019 —- Department of Finance 
Code of Ethics SAI Aruba 2020 
Handbook financial administration 
Integrity Policy plan 2020 
Instruction Manual monitoring 2020 
Management Report Self-Assessment IntoSAINT SAI Aruba (2012) 
Manual for financial administration 
Notes for planning audit topics 2020-2021 
Note on findings 
Organizational handbook: Organization description, structure and job description (2012) 
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Personnel Handbook 2012 

Procedures Manual General operations 

Protocol Secretary-General 2000 

Risk-analysis 2020 

Service Level Agreement 2003 

Strategic Policy plan: The “new” Court of Audit (the outcome) 2011 
Strategic Policy plan: result-oriented 2019-2022 

Summary SWOT-analysis report 

Work agreement external party 


(iv) Others 
Letter to/from the minister or government department 


Records, emails, letters, website, screenshots 


Audit Files Reviewed 


(i) Financial Audit 
Investigation on the National Financial statement of Aruba 2017 
Investigation on the National Financial statement of Aruba 2018 


(ii) Performance Audit 
Public Private Partnership: Investigation of the contract management and provision 


of information regarding the projects Green Corridor and Watty Vos Boulevard. 
(iii) Compliance Audit 


Investigation on the National Financial statement of Aruba 2017 
Investigation on the National Financial statement of Aruba 2018 
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